CVE-2026-27143 PUBLISHED

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Assigner: Go
Reserved: 17.02.2026 Published: 08.04.2026 Updated: 08.04.2026

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Product Status

Vendor Go toolchain
Product cmd/compile
Versions Default: unaffected
  • affected from 0 to 1.25.9 (excl.)
  • affected from 1.26.0-0 to 1.26.2 (excl.)

Credits

  • Jakub Ciolek - https://ciolek.dev/

References

Problem Types

  • CWE-190: Integer Overflow or Wraparound