# UNDF: UNDF-2026-000000152
diff --git a/llvm/lib/Analysis/GlobalsModRef.cpp b/llvm/lib/Analysis/GlobalsModRef.cpp
index 295e267..d72e824 100644
--- a/llvm/lib/Analysis/GlobalsModRef.cpp
+++ b/llvm/lib/Analysis/GlobalsModRef.cpp
@@ -529,6 +529,9 @@ void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
 
     // Collect the mod/ref properties due to called functions.  We only compute
     // one mod-ref set.
+    // CWE-407 fix: build O(1) set for SCC membership test inside the loop.
+    // is_contained(SCC, CalleeNode) was O(V) per callee; SCCSet.count() is O(1).
+    SmallPtrSet<CallGraphNode *, 8> SCCSet(SCC.begin(), SCC.end());
     for (unsigned i = 0, e = SCC.size(); i != e && !KnowNothing; ++i) {
       if (!F) {
         KnowNothing = true;
@@ -567,7 +570,7 @@ void GlobalsAAResult::AnalyzeCallGraph(CallGraph &CG, Module &M) {
             // Can't say anything about it.  However, if it is inside our SCC,
             // then nothing needs to be done.
             CallGraphNode *CalleeNode = CG[Callee];
-            if (!is_contained(SCC, CalleeNode))
+            if (!SCCSet.count(CalleeNode))
               KnowNothing = true;
           }
         } else {