CVE-2026-27143: Go cmd/compile missing bounds checks on induction variables leading to memory corruption

Overview

CVE-2026-27143 is a memory safety issue in cmd/compile, the compiler component of the Go toolchain. According to the record, arithmetic involving induction variables inside loops was not correctly checked for underflow or overflow. The compiler could therefore accept code that performs invalid indexing at runtime. The Go project published a vendor advisory as GO-2026-4868 and a patch tracked in go.dev/cl/763765.

Impact

The record describes the consequence as potential memory corruption in programs built with the affected compiler. The NVD assessment in the record is CVSS 3.1 9.8 (Critical) with network attack vector, low complexity, no privileges and no user interaction, and high confidentiality, integrity and availability impact. The SSVC data in the record rates technical impact as total and automatable as yes.

Affected products and versions

The record lists two affected entries for the Go toolchain:

• Go toolchain cmd/compile: versions before 1.25.9, and from 1.26.0 up to before 1.26.2.
• Golang Go: versions before 1.25.9, and from 1.26.0 up to before 1.26.2.

The record does not list affected versions outside these ranges. Consult the vendor advisory for the authoritative list.

Exploitation status

The CISA KEV catalog does not list this CVE, so no confirmed exploitation in the wild is recorded in the sources consulted. The SSVC exploitation field is none, and the EPSS probability in the record is 0.00536 (percentile 0.44397). These figures reflect the data available at the time of analysis and do not confirm or rule out exploitation.

Remediation and mitigation

• Upgrade the Go toolchain to 1.25.9 or later on the 1.25 branch, since the affected range ends before 1.25.9.
• Upgrade to 1.26.2 or later on the 1.26 branch, since the affected range ends before 1.26.2.
• Rebuild and redeploy binaries produced with an affected toolchain, because the defect is in the compiler and affects the output.
• Review the Go release announcement in the golang-announce mailing list for release details.

Detection guidance

• Inventory build environments and CI runners to identify which Go toolchain versions are installed, using the version output of the go command.
• Track which artifacts were built with versions in the affected ranges so they can be rebuilt after patching.
• Monitor for unexpected crashes or memory faults in services built with affected toolchains, recognising that such symptoms are not specific to this issue.

Limitations of the available information

The record does not include a CWE classification, so the weakness type is unknown. It does not describe a specific triggering pattern, affected platforms or public proof-of-concept activity, and this analysis does not add such details. Whether a given application is exploitable depends on its code and build configuration, which is unknown from the record.

Frequently asked questions

What is CVE-2026-27143?

It is a memory safety issue in the Go compiler (cmd/compile) where arithmetic over loop induction variables was not checked for underflow or overflow, which could allow invalid indexing at runtime.

Which Go versions are affected?

According to the record, versions before 1.25.9 and versions from 1.26.0 up to before 1.26.2 are affected.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Upgrade the Go toolchain to 1.25.9 or later on the 1.25 branch, or to 1.26.2 or later on the 1.26 branch, then rebuild affected binaries.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.