CVE-2026-27144 PUBLISHED

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

Assigner: Go
Reserved: 17.02.2026 Published: 08.04.2026 Updated: 08.04.2026

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Product Status

Vendor Go toolchain
Product cmd/compile
Versions Default: unaffected
  • affected from 0 to 1.25.9 (excl.)
  • affected from 1.26.0-0 to 1.26.2 (excl.)

Credits

  • Jakub Ciolek - https://ciolek.dev/

References

Problem Types

  • CWE-440: Expected Behavior Violation