# CVE-2026-27144: Google Go toolchain memory corruption in cmd/compile

Source: https://junglewise.ai/threats/cve-2026-27144-google-go-toolchain-memory-corruption-in-cmd-compile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-27144 · Severity: high · CVSS 7.1 · Published 2026-04-08

A vulnerability in the Go programming language compiler could allow for memory corruption in compiled applications. The Go compiler, which translates human-readable code into machine instructions, fails to correctly handle certain memory operations when specific interface conversions are used. This could lead to unpredictable application behavior or crashes in software built with affected versions of the Go toolchain.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-27144 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27144 being exploited in the wild.

**How severe is CVE-2026-27144?** High severity, with a CVSS score of 7.1, published 8 April 2026.

**Which products and versions are affected?** toolchain (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2.

**Is there a fix for CVE-2026-27144?** Yes. toolchain (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27144 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-27144?** Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toolchain (Go): upgrade to 1.26.2 or later

  ```sh
  go get toolchain@v1.26.2
  ```


## Technical details

A type confusion vulnerability (CWE-843) exists in the Go compiler's 'cmd/compile' component. The compiler is designed to unwrap pointers that are operands of a memory move to determine if the source and destination overlap; however, a no-op interface conversion prevents this unwrapping. This failure leads to an incorrect determination that moves are non-overlapping, causing the compiler to generate unsafe machine code that results in memory corruption at runtime. The issue affects the Go toolchain versions prior to 1.25.9 and 1.26.x versions prior to 1.26.2. Patches have been released in Go 1.25.9 and 1.26.2.

## Affected products

- Google Go toolchain (cmd/compile) < 1.25.9, >= 1.26.0-0 < 1.26.2

## Identifiers

- CVE-2026-27144
- GO-2026-4867

## Timeline

- 2026-03-25: disclosed: Issue reported to Go project by Jakub Ciolek
- 2026-04-07: advisory: Initial advisory published by Go Project
- 2026-04-08: patched: CVE published and fixes available in Go 1.25.9 and 1.26.2

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/763764](https://go.dev/cl/763764)
- [https://go.dev/issue/78371](https://go.dev/issue/78371)
- [https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)
- [https://pkg.go.dev/vuln/GO-2026-4867](https://pkg.go.dev/vuln/GO-2026-4867)

## Related threats

- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)
- [Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives)