Executive brief
LLVM is a widely used collection of modular compiler and toolchain technologies. A vulnerability in its symbol table management component could allow a local user to cause a system crash or unexpected behavior. This impact is primarily limited to the availability of the compiler tools during the build process.
Technical details
A stack-based buffer overflow vulnerability was identified in the llvm::StringMap::insert function within lib/IR/ValueSymbolTable.cpp of the LLVM project. The issue occurs during the manipulation of value names within the ValueSymbolTable module. An attacker with local access can trigger this overflow, potentially leading to a crash of the LLVM-based tool. While a proof-of-concept exploit has been made public, the vulnerability currently only results in a partial impact on availability (DoS). As of the advisory date, the project has been informed but a formal patch has not been confirmed.
Affected products
- llvm llvm-project up to 22.1.6
Timeline
- 2026-06-29: advisory: NVD publication date
- 2026-06-29: disclosed: Public disclosure of the vulnerability and PoC