Executive brief
A vulnerability in the Go programming language compiler can cause applications to be built with incorrect memory safety checks. This flaw allows programs to access memory outside of their intended boundaries during loop operations, which could lead to data theft, system crashes, or unauthorized code execution. Organizations using Go should recompile their applications with the updated compiler versions to ensure they are protected.
Technical details
A vulnerability exists in the Go compiler's (cmd/compile) optimization phase where arithmetic operations on induction variables in loops are not properly validated for overflow or underflow. This flaw causes the compiler to incorrectly eliminate bounds checks for slices and arrays, assuming they are safe when they are not. An attacker could potentially exploit this by providing inputs that trigger these edge cases in a compiled Go application, leading to out-of-bounds memory access and corruption. The issue is fixed in Go versions 1.25.9 and 1.26.2.
Affected products
- Go Project Go toolchain (cmd/compile) < 1.25.9, >= 1.26.0-0 < 1.26.2
Timeline
- 2026-03-24: disclosed: Issue reported to Go Project by Jakub Ciolek
- 2026-04-07: advisory: Go Project published vendor advisory GO-2026-4868
- 2026-04-08: disclosed: CVE-2026-27143 published