HarborGuard / CVE
Back to search
HIGHCVE-2026-27144Published Modified CNA Go

CVE-2026-27144: Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Metrics

CVSS v3.1
7.1
Severity
HIGH
Fixed in
1.25.9
Affected Products
1

Fix available

1.25.91.26.2
Affected packages
  • Go toolchain / cmd/compile
    < 1.25.9 (from 0) · < 1.26.2 (from 1.26.0-0)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
References