CVE-2026-27144: CWE-440: Expected Behavior Violation in Go toolchain cmd/compile
CVE-2026-27144 is a high-severity vulnerability in the Go toolchain's cmd/compile component. The issue arises because the compiler fails to correctly unwrap pointers during memory move operations due to a no-op interface conversion. This flaw can cause the compiler to incorrectly determine non-overlapping memory moves, potentially leading to memory corruption at runtime. The vulnerability affects Go versions up to 1.26.0-0. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.
AI Analysis
Technical Summary
The Go toolchain's cmd/compile component contains a vulnerability (CWE-440) where a no-op interface conversion prevents the compiler from properly unwrapping pointers that are operands of memory move operations. This incorrect handling can cause the compiler to misjudge whether memory regions overlap, potentially resulting in memory corruption during program execution. The vulnerability affects versions up to 1.26.0-0 and has a CVSS v3.1 base score of 7.1, indicating high severity. No patch or official fix has been disclosed, and the issue is not related to cloud services.
Potential Impact
The vulnerability can lead to memory corruption at runtime in programs compiled with affected versions of the Go toolchain. This may cause integrity issues or application crashes. The CVSS vector indicates local attack complexity and privileges are required, with no user interaction needed. Confidentiality is not impacted, but integrity and availability are highly impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or applying any available workarounds from the vendor. Monitor official Go project communications for updates on patches or mitigations.
CVE-2026-27144: CWE-440: Expected Behavior Violation in Go toolchain cmd/compile
Description
CVE-2026-27144 is a high-severity vulnerability in the Go toolchain's cmd/compile component. The issue arises because the compiler fails to correctly unwrap pointers during memory move operations due to a no-op interface conversion. This flaw can cause the compiler to incorrectly determine non-overlapping memory moves, potentially leading to memory corruption at runtime. The vulnerability affects Go versions up to 1.26.0-0. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Go toolchain's cmd/compile component contains a vulnerability (CWE-440) where a no-op interface conversion prevents the compiler from properly unwrapping pointers that are operands of memory move operations. This incorrect handling can cause the compiler to misjudge whether memory regions overlap, potentially resulting in memory corruption during program execution. The vulnerability affects versions up to 1.26.0-0 and has a CVSS v3.1 base score of 7.1, indicating high severity. No patch or official fix has been disclosed, and the issue is not related to cloud services.
Potential Impact
The vulnerability can lead to memory corruption at runtime in programs compiled with affected versions of the Go toolchain. This may cause integrity issues or application crashes. The CVSS vector indicates local attack complexity and privileges are required, with no user interaction needed. Confidentiality is not impacted, but integrity and availability are highly impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding affected versions or applying any available workarounds from the vendor. Monitor official Go project communications for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Go
- Date Reserved
- 2026-02-17T19:57:28.435Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5da2d43e2781badfbe678
Added to database: 04/08/2026, 04:31:41 UTC
Last enriched: 06/03/2026, 21:14:05 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 122
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.