A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-597e8f9de1 advisory.

    Backport fixes from LLVM 23

    - Fix an issue that could cause a buffer overflow when reading a corrupted bitcode file.
    - Fix a miscompilation known to affect rust applications.
    - Fix a miscompilation in x86 vectorized code.
    - Fix 2 issues in LLD.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ebbaee3606 advisory.

    Automatic update for python-llvmlite-0.48.0-1.fc45.

    ##### **Changelog**

    ```
    * Fri Jul  3 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 0.48.0-1
    - Update to 0.48.0
    - Closes RHBZ#2453491; fixes RHBZ#2495139; fixes RHBZ#2496401

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function     GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File     Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the     local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about     whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside     its documented security scope and therefore not considered a security vulnerability. (CVE-2026-13574)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
329160	Fedora 44 : llvm (2026-597e8f9de1)	Nessus	Fedora Local Security Checks	Local	medium
325235	Fedora 45 : python-llvmlite (2026-ebbaee3606)	Nessus	Fedora Local Security Checks	Local	medium
323938	Linux Distros Unpatched Vulnerability : CVE-2026-13574	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-13574

medium

Tenable Plugins

medium

medium

medium