CVE-2026-27143: Missing bound checks can lead to memory corruption in safe Go in cmd/compile
Published Apr 8, 2026
·Updated
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Affected Software
3 affected components
go Go cmd/compile
Golang Go<1.25.9
Golang Go>=1.26.0<1.26.2
Remediation
Patch Available
Event History
Apr 8, 2026
CVE Published
via MITRE·01:06 AM
Data Sourced
via MITRE·01:06 AM
DescriptionWeakness
Data Sourced
via Red Hat·02:01 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:16 AM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-27143?
CVE-2026-27143 is classified with a severity that indicates potential for severe impact due to memory corruption.
2
How do I fix CVE-2026-27143?
To fix CVE-2026-27143, update to a patched version of Go that resolves the missing bound checks.
3
What causes CVE-2026-27143?
CVE-2026-27143 is caused by missing bound checks in the Go cmd/compile module, allowing for invalid memory indexing.
4
What are the affected Go versions for CVE-2026-27143?
CVE-2026-27143 affects Go versions prior to 1.25.9 and between 1.26.0 and 1.26.2.
5
Are there any workarounds for CVE-2026-27143?
Workarounds for CVE-2026-27143 may include avoiding specific compiler features that trigger the memory corruption issue.