| id: GO-2026-4867 |
| modules: |
| - module: cmd |
| versions: |
| - fixed: 1.25.9 |
| - introduced: 1.26.0-0 |
| - fixed: 1.26.2 |
| vulnerable_at: 1.26.1 |
| packages: |
| - package: cmd/compile |
| summary: |- |
| Miscompilation allows memory corruption via CONVNOP-wrapped array copy in |
| cmd/compile |
| description: |- |
| The compiler is meant to unwrap pointers which are the operands of a memory |
| move; a no-op interface conversion prevented the compiler from making the |
| correct determination about non-overlapping moves, potentially leading to memory |
| corruption at runtime. |
| credits: |
| - Jakub Ciolek - https://ciolek.dev/ |
| references: |
| - fix: https://go.dev/cl/763764 |
| - report: https://go.dev/issue/78371 |
| - web: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU |
| cve_metadata: |
| id: CVE-2026-27144 |
| cwe: 'CWE-440: Expected Behavior Violation' |
| source: |
| id: go-security-team |
| review_status: REVIEWED |
