Arithmetic Overflows in Go Compiler Affecting Memory Management
CVE-2026-27143

9.8CRITICAL

Key Information:

Vendor

Go Toolchain

Status
Cmd/compile
Vendor
CVE Published:
8 April 2026

What is CVE-2026-27143?

A vulnerability exists in the Go Compiler where arithmetic operations on induction variables within loops may not be adequately checked for underflow or overflow conditions. This oversight can result in invalid memory indexing at runtime, leading to potential memory corruption. Exploiting this flaw could disrupt the execution of applications relying on the compiler, emphasizing the need for timely updates and patches.

Affected Version(s)

cmd/compile 0 < 1.25.9

cmd/compile 1.26.0-0 < 1.26.2

References

https://go.dev/cl/763765
https://go.dev/issue/78333
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakub Ciolek - https://ciolek.dev/
.