Threats affecting pkg:golang/cmd/compile

CVE-2026-27144 is a high-severity vulnerability in the Go toolchain's cmd/compile component. The issue arises because the compiler fails to correctly unwrap pointers during memory move operations due to a no-op interface conversion. This flaw can cause the compiler to incorrectly determine non-overlapping memory moves, potentially leading to memory corruption at runtime. The vulnerability affects Go versions up to 1.26.0-0. There is no vendor-provided patch or official remediation guidance available at this time, and no known exploits have been reported in the wild.

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.