HarborGuard / CVE
Back to search
CRITICALCVE-2026-27143Published Modified CNA Go

CVE-2026-27143: Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

Metrics

CVSS v3.1
9.8
Severity
CRITICAL
Fixed in
1.25.9
Affected Products
1

Fix available

1.25.91.26.2
Affected packages
  • Go toolchain / cmd/compile
    < 1.25.9 (from 0) · < 1.26.2 (from 1.26.0-0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References