CVE-2026-27144— Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-27144
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Source: NVD (National Vulnerability Database)
Vulnerability Description
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Google Go 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google Go是美国谷歌（Google）公司的一种静态强类型、编译型、并发型，并具有垃圾回收功能的编程语言。 Google Go存在安全漏洞，该漏洞源于无操作接口转换阻止编译器正确确定非重叠移动，可能导致运行时内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Go toolchain | cmd/compile | 0 ~ 1.25.9 | - |
II. Public POCs for CVE-2026-27144
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27144
请登录查看更多情报信息。
Same Patch Batch · Go toolchain · 2026-04-08 · 3 CVEs total
| CVE-2026-27140 | Code execution vulnerability in SWIG code generation in cmd/go | |
| CVE-2026-27143 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile |
IV. Related Vulnerabilities
Same vendor: Go toolchain
- CVE-2026-42501
Malicious module proxy can bypass checksum database in cmd/g - CVE-2026-39817
Invoking "go tool pack" does not sanitize output paths in cm - CVE-2026-39819
Invoking "go bug" follows symlinks in predictable temporary - CVE-2026-27140
Code execution vulnerability in SWIG code generation in cmd/ - CVE-2026-27143
Missing bound checks can lead to memory corruption in safe G
V. Comments for CVE-2026-27144
No comments yet