CVE-2024-31852

LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production."

• https://bugs.chromium.org/p/llvm/issues/detail?id=69
• https://github.com/llvm/llvm-project/issues/80287
• https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
• https://llvm.org/docs/Security.html
• https://bugs.chromium.org/p/llvm/issues/detail?id=69
• https://github.com/llvm/llvm-project/issues/80287
• https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
• https://llvm.org/docs/Security.html

Published

Apr 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31847An issue was discovered in Italtel Embrace 1.6.4. A stored c…6.1
• CVE-2024-31848A path traversal vulnerability exists in the Java version of…9.8
• CVE-2024-31849A path traversal vulnerability exists in the Java version of…9.8
• CVE-2024-3185 A key used in logging.json does not follow the least privil…6.8
• CVE-2024-31850A path traversal vulnerability exists in the Java version of…8.6
• CVE-2024-31851A path traversal vulnerability exists in the Java version of…8.6
• CVE-2024-31853A vulnerability has been identified in SICAM TOOLBOX II (All…8.1
• CVE-2024-31854A vulnerability has been identified in SICAM TOOLBOX II (All…8.1
• CVE-2024-31856An attacker with certain MQTT permissions can create malicio…8.8
• CVE-2024-31857Forminator prior to 1.15.4 contains a cross-site scripting v…5.4
• CVE-2024-31858Out-of-bounds write for some Intel(R) QuickAssist Technology…7.8
• CVE-2024-31859Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x…6.3