Is CVE-2026-27143 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27143 being exploited in the wild.

How severe is CVE-2026-27143?

Critical severity, with a CVSS score of 9.8, published 8 April 2026.

Which products and versions are affected?

toolchain (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2.

Is there a fix for CVE-2026-27143?

Yes. toolchain (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27143 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27143?

Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27143: Go toolchain memory corruption in cmd/compile loop induction

CVE-2026-27143 · Severity: critical · CVSS 9.8 · Published 2026-04-08

A vulnerability in the Go programming language compiler can cause applications to be built with incorrect memory safety checks. This flaw allows programs to access memory outside of their intended boundaries during loop operations, which could lead to data theft, system crashes, or unauthorized code execution. Organizations using Go should recompile their applications with the updated compiler versions to ensure they are protected.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-27143 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27143 being exploited in the wild.
How severe is CVE-2026-27143?: Critical severity, with a CVSS score of 9.8, published 8 April 2026.
Which products and versions are affected?: toolchain (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2.
Is there a fix for CVE-2026-27143?: Yes. toolchain (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27143 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27143?: Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.26.2 or later
```
go get toolchain@v1.26.2
```

Technical details

A vulnerability exists in the Go compiler's (cmd/compile) optimization phase where arithmetic operations on induction variables in loops are not properly validated for overflow or underflow. This flaw causes the compiler to incorrectly eliminate bounds checks for slices and arrays, assuming they are safe when they are not. An attacker could potentially exploit this by providing inputs that trigger these edge cases in a compiled Go application, leading to out-of-bounds memory access and corruption. The issue is fixed in Go versions 1.25.9 and 1.26.2.

Affected products

Go Project Go toolchain (cmd/compile) < 1.25.9, >= 1.26.0-0 < 1.26.2

Identifiers

CVE-2026-27143
GO-2026-4868

Timeline

2026-03-24: disclosed: Issue reported to Go Project by Jakub Ciolek
2026-04-07: advisory: Go Project published vendor advisory GO-2026-4868
2026-04-08: disclosed: CVE-2026-27143 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.