CVE-2024-31852
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being...
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
CVE-2024-31852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2024-29722
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
EUVD-2024-29722- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gj98-2c7c-vmc4
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being...
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
GHSA-gj98-2c7c-vmc4- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
CVE-2024-31852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
CVE-2024-31852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-31852
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
DEBIAN-CVE-2024-31852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2024-31852
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
UBUNTU-CVE-2024-31852- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-39713 No score
CVE-2024-31852 affecting package lld for versions less than 18.1.2-2
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39713- Updated
- 2026-11-02
OSVAZL-39728 No score
CVE-2024-31852 affecting package lldb for versions less than 18.1.2-2
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39728- Updated
- 2026-11-02
OSVAZL-39758 No score
CVE-2024-31852 affecting package llvm for versions less than 18.1.2-3
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39758- Updated
- 2026-11-02
OSVAZL-39776 No score
CVE-2024-31852 affecting package clang for versions less than 18.1.2-2
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39776- Updated
- 2026-11-02
OSVAZL-39785 No score
CVE-2024-31852 affecting package rust for versions less than 1.75.0-9
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39785- Updated
- 2026-11-05
OSVAZL-39791 No score
CVE-2024-31852 affecting package compiler-rt for versions less than 18.1.2-2
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39791- Updated
- 2026-11-02
OSVAZL-39830 No score
CVE-2024-31852 affecting package clang16 for versions less than 16.0.0-1
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39830- Updated
- 2026-11-02
OSVAZL-39842 No score
CVE-2024-31852 affecting package rust for versions less than 1.72.0-8
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-39842- Updated
- 2026-11-02
OSVAZL-49774 No score
CVE-2024-31852 affecting package libcxx for versions less than 18.1.2-3
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."
- Record
AZL-49774- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lldAzure Linux:3 |
before 18.1.2-2 | 18.1.2-2 |
lldbAzure Linux:3 |
before 18.1.2-2 | 18.1.2-2 |
llvmAzure Linux:3 |
before 18.1.2-3 | 18.1.2-3 |
clangAzure Linux:3 |
before 18.1.2-2 | 18.1.2-2 |
rustAzure Linux:3 |
before 1.75.0-9 | 1.75.0-9 |
compiler-rtAzure Linux:3 |
before 18.1.2-2 | 18.1.2-2 |
clang16Azure Linux:2 |
before 16.0.0-1 | 16.0.0-1 |
rustAzure Linux:2 |
before 1.72.0-8 | 1.72.0-8 |
libcxxAzure Linux:3 |
before 18.1.2-3 | 18.1.2-3 |
llvm-toolchain-14Debian:12 |
All versions, plus listed versions 1:14.0.6-121:14.0.6-12+powerpc1:14.0.6-131:14.0.6-141:14.0.6-16 Show 6 moreShow less1:14.0.6-16.11:14.0.6-16.1~exp11:14.0.6-171:14.0.6-181:14.0.6-191:14.0.6-20 |
None known |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
llvm-toolchain-15Debian:12 |
All versions, plus listed versions 1:15.0.6-41:15.0.6-5~exp11:15.0.6-5~exp21:15.0.6-5~exp31:15.0.7-1 Show 19 moreShow less1:15.0.7-1+hurd.11:15.0.7-101:15.0.7-10.1~exp11:15.0.7-111:15.0.7-11.11:15.0.7-121:15.0.7-131:15.0.7-141:15.0.7-151:15.0.7-15+hurd.11:15.0.7-21:15.0.7-31:15.0.7-41:15.0.7-51:15.0.7-5~exp11:15.0.7-61:15.0.7-71:15.0.7-81:15.0.7-9 |
None known |
llvm-toolchain-16Debian:12 |
All versions, plus listed versions 1:16.0.0-1~exp11:16.0.0-1~exp21:16.0.0-1~exp31:16.0.0-1~exp41:16.0.0-1~exp5 Show 45 moreShow less1:16.0.0~+rc1-1~exp11:16.0.0~+rc2-1~exp11:16.0.0~+rc3-1~exp11:16.0.0~+rc4-1~exp11:16.0.1-1~exp11:16.0.1-1~exp21:16.0.2-1~exp11:16.0.3-1~exp11:16.0.4-1~exp11:16.0.5-11:16.0.5-1~exp11:16.0.6-11:16.0.6-101:16.0.6-111:16.0.6-121:16.0.6-131:16.0.6-141:16.0.6-151:16.0.6-15+x321:16.0.6-15exp11:16.0.6-15~deb11u11:16.0.6-15~deb11u21:16.0.6-15~deb12u11:16.0.6-161:16.0.6-171:16.0.6-17exp11:16.0.6-181:16.0.6-191:16.0.6-19.1~exp11:16.0.6-21:16.0.6-201:16.0.6-211:16.0.6-221:16.0.6-231:16.0.6-241:16.0.6-251:16.0.6-261:16.0.6-271:16.0.6-27+hurd.11:16.0.6-27+x321:16.0.6-31:16.0.6-41:16.0.6-51:16.0.6-61:16.0.6-7 |
None known |
llvm-toolchain-17Debian:13 |
All versions, plus listed versions 1:17.0.6-221:17.0.6-23 |
None known |
llvm-toolchain-18Debian:13 |
before 1:18.1.3-1 | 1:18.1.3-1 |
llvm-toolchain-3.6Ubuntu:14.04:LTS |
All versions, plus listed versions 1:3.6-2ubuntu1~trusty11:3.6-2ubuntu1~trusty2 |
None known |
llvm-toolchain-3.8Ubuntu:14.04:LTS |
All versions, plus listed versions 1:3.8-2ubuntu3~trusty41:3.8-2ubuntu3~trusty5 |
None known |
llvm-toolchain-3.9Ubuntu:14.04:LTS |
All versions, plus listed versions 1:3.9.1-4ubuntu3~14.04.21:3.9.1-4ubuntu3~14.04.3 |
None known |
llvm-toolchain-3.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1:3.6.2-11:3.6.2-31:3.6.2-3build11:3.6.2-3ubuntu11:3.6.2-3ubuntu2 |
None known |
llvm-toolchain-3.8Ubuntu:16.04:LTS |
All versions, plus listed versions 1:3.8~+rc1-1~exp1ubuntu31:3.8~+rc2-1~exp1ubuntu21:3.8-2ubuntu11:3.8-2ubuntu31:3.8-2ubuntu4 |
None known |
llvm-toolchain-4.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1:4.0-1ubuntu1~16.04.11:4.0-1ubuntu1~16.04.2 |
None known |
llvm-toolchain-5.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1:5.0-3~16.04.1 |
None known |
llvm-toolchain-6.0Ubuntu:16.04:LTS |
All versions, plus listed versions 1:6.0-1ubuntu2~16.04.1 |
None known |
llvm-toolchain-3.5Ubuntu:16.04:LTS |
All versions, plus listed versions 1:3.5.2-21:3.5.2-31:3.5.2-3build11:3.5.2-3build21:3.5.2-3ubuntu1 |
None known |
llvm-toolchain-3.7Ubuntu:16.04:LTS |
All versions, plus listed versions 1:3.7-2ubuntu11:3.7-2ubuntu21:3.7-4ubuntu11:3.7.1-1ubuntu11:3.7.1-1ubuntu2 Show 4 moreShow less1:3.7.1-1ubuntu31:3.7.1-1ubuntu41:3.7.1-2ubuntu11:3.7.1-2ubuntu2 |
None known |
llvm-toolchain-3.9Ubuntu:16.04:LTS |
All versions, plus listed versions 1:3.9.1-4ubuntu3~16.04.11:3.9.1-4ubuntu3~16.04.2 |
None known |
llvm-toolchain-8Ubuntu:16.04:LTS |
All versions, plus listed versions 1:8-3~ubuntu16.04.1 |
None known |
llvm-toolchain-10Ubuntu:18.04:LTS |
All versions, plus listed versions 1:10.0.0-4ubuntu1~18.04.11:10.0.0-4ubuntu1~18.04.2 |
None known |
llvm-toolchain-3.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1:3.9.1-17ubuntu11:3.9.1-18ubuntu11:3.9.1-19ubuntu1 |
None known |
llvm-toolchain-6.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1:6.0~+rc1-11:6.0~+rc2-11:6.0-1ubuntu11:6.0-1ubuntu2 |
None known |
llvm-toolchain-7Ubuntu:18.04:LTS |
All versions, plus listed versions 1:7-3~ubuntu0.18.04.1 |
None known |
llvm-toolchain-8Ubuntu:18.04:LTS |
All versions, plus listed versions 1:8-3~ubuntu18.04.11:8-3~ubuntu18.04.2 |
None known |
llvm-toolchain-9Ubuntu:18.04:LTS |
All versions, plus listed versions 1:9-2~ubuntu18.04.11:9-2~ubuntu18.04.2 |
None known |
llvm-toolchain-3.7Ubuntu:18.04:LTS |
All versions, plus listed versions 1:3.7.1-5ubuntu3 |
None known |
llvm-toolchain-4.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1:4.0.1-61:4.0.1-81:4.0.1-10 |
None known |
llvm-toolchain-5.0Ubuntu:18.04:LTS |
All versions, plus listed versions 1:5.0-31:5.0-41:5.0.1-11:5.0.1-21:5.0.1-4 |
None known |
llvm-toolchain-10Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10~++20200121023453+de4b2a7fad6-1~exp11:10.0.0~+rc1-1~exp11:10.0.0~+rc2-2~build21:10.0.0~+rc2-21:10.0.0~+rc3-1 Show 9 moreShow less1:10.0.0~+rc3-1build11:10.0.0~+rc4-11:10.0.0~+rc5-1ubuntu11:10.0.0-1ubuntu11:10.0.0-1ubuntu21:10.0.0-2ubuntu11:10.0.0-2ubuntu21:10.0.0-31:10.0.0-4ubuntu1 |
None known |
llvm-toolchain-11Ubuntu:20.04:LTS |
All versions, plus listed versions 1:11.0.0-2~ubuntu20.04.1 |
None known |
llvm-toolchain-12Ubuntu:20.04:LTS |
All versions, plus listed versions 1:12.0.0-3ubuntu1~20.04.31:12.0.0-3ubuntu1~20.04.41:12.0.0-3ubuntu1~20.04.5 |
None known |
llvm-toolchain-9Ubuntu:20.04:LTS |
All versions, plus listed versions 1:9-21:9.0.0-3ubuntu21:9.0.0-4ubuntu41:9.0.1~+rc2-1~exp11:9.0.1~+rc2-1~exp1ubuntu1 Show 10 moreShow less1:9.0.1-11:9.0.1-21:9.0.1-6build11:9.0.1-8build11:9.0.1-8ubuntu11:9.0.1-9ubuntu11:9.0.1-101:9.0.1-111:9.0.1-11ubuntu11:9.0.1-12 |
None known |
llvm-toolchain-6.0Ubuntu:20.04:LTS |
All versions, plus listed versions 1:6.0.1-111:6.0.1-11ubuntu11:6.0.1-121:6.0.1-14 |
None known |
llvm-toolchain-7Ubuntu:20.04:LTS |
All versions, plus listed versions 1:7.0.1-9build11:7.0.1-9ubuntu21:7.0.1-101:7.0.1-10build11:7.0.1-12 |
None known |
llvm-toolchain-8Ubuntu:20.04:LTS |
All versions, plus listed versions 1:8.0.1-3build11:8.0.1-41:8.0.1-4ubuntu31:8.0.1-7build11:8.0.1-7ubuntu11:8.0.1-8ubuntu11:8.0.1-9 |
None known |
llvm-toolchain-11Ubuntu:22.04:LTS |
All versions, plus listed versions 1:11.0.1-2ubuntu51:11.1.0-6 |
None known |
llvm-toolchain-12Ubuntu:22.04:LTS |
All versions, plus listed versions 1:12.0.1-8build11:12.0.1-161:12.0.1-19ubuntu3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31852 is a medium vulnerability (CVSS 5.9) in llvm, published April 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.99%, the 62nd percentile. Fixed in lld 18.1.2-2.
References
Left out here: 2 versions. The JSON record has them.