This vulnerability (CVE-2026-27140) in the Go toolchain's cmd/go arises from improper handling of SWIG file names containing 'cgo'. Maliciously crafted payloads can exploit this trust boundary violation to smuggle code and achieve arbitrary code execution at build time. The issue is tracked under CWE-501 (Trust Boundary Violation) and CWE-641 (Improper Control of a Resource Through its Lifetime). The vulnerability is rated high severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Red Hat advisories provide updated golang packages that fix this and related vulnerabilities. The affected versions include golang prior to 1.26.0-0 as indicated in the input data.

Successful exploitation allows an attacker to execute arbitrary code during the build process by bypassing trust boundaries in cmd/go when processing SWIG file names. This compromises confidentiality, integrity, and availability of the build environment and potentially the resulting binaries. The vulnerability requires no privileges and no user interaction other than triggering the build with malicious input. The high CVSS score reflects the critical impact on system security.

Red Hat has released security updates for golang packages that address CVE-2026-27140. Users should apply these official patches as provided in the referenced Red Hat advisories (e.g., RHSA-2026:16024 and others). Since this is a vulnerability in the build toolchain, updating to the fixed golang package version is the recommended remediation. Patch status is not explicitly stated in the input but the presence of multiple Red Hat errata indicates that fixes are available. Check the vendor advisories for detailed update instructions and apply them promptly.