CVE-2026-27143: Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Other sources
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27143?
CVE-2026-27143 is classified with a severity that indicates potential for severe impact due to memory corruption.
How do I fix CVE-2026-27143?
To fix CVE-2026-27143, update to a patched version of Go that resolves the missing bound checks.
What causes CVE-2026-27143?
CVE-2026-27143 is caused by missing bound checks in the Go cmd/compile module, allowing for invalid memory indexing.
What are the affected Go versions for CVE-2026-27143?
CVE-2026-27143 affects Go versions prior to 1.25.9 and between 1.26.0 and 1.26.2.
Are there any workarounds for CVE-2026-27143?
Workarounds for CVE-2026-27143 may include avoiding specific compiler features that trigger the memory corruption issue.