CVE-2023-46049

LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted...

5.3 MediumFix availableDisputed

LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.68%Up 0.6 points since Mar 27, 2024

What each source reports

CVE List Score used 5.3

Record: CVE-2023-46049
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2023-50310 5.3

Record: EUVD-2023-50310
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vggp-p864-ph99 5.3

LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted...

Record: GHSA-vggp-p864-ph99
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-476
Updated: 2026-11-02

NVD 5.3

Record: CVE-2023-46049
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2023-46049 5.3

CVE-2023-46049 does not affect BellSoft software

Record: BELL-CVE-2023-46049
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVOESA-2024-1481 7.5

llvm security update

LLVM is a compiler infrastructure designed for compile-time, link-time, runtime, and idle-time optimization of programs from arbitrary programming languages.

Security Fix(es):

Record: OESA-2024-1481
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`llvm` openEuler:20.03-LTS-SP1	before 10.0.1-3.oe1	10.0.1-3.oe1
`llvm` openEuler:20.03-LTS-SP4	before 10.0.1-4.oe2003sp4	10.0.1-4.oe2003sp4
`llvm` openEuler:22.03-LTS	before 12.0.1-7.oe2203sp3	12.0.1-7.oe2203sp3
`llvm` openEuler:22.03-LTS-SP1	before 12.0.1-7.oe2203sp1	12.0.1-7.oe2203sp1
`llvm` openEuler:22.03-LTS-SP2	before 12.0.1-7.oe2203sp2	12.0.1-7.oe2203sp2
`llvm` openEuler:22.03-LTS-SP3	before 12.0.1-7.oe2203sp3	12.0.1-7.oe2203sp3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-46049 is a medium vulnerability (CVSS 5.3) in llvm, published March 27, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in llvm 10.0.1-3.oe1.