{"id":"GO-2026-4868","aliases":["BIT-golang-2026-27143","CVE-2026-27143"],"title":"Missing bound checks can lead to memory corruption in safe Go in cmd/compile","titleSource":"OSV","descriptionSource":"OSV","description":"Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.","severity":"unknown","score":null,"published":"2026-04-07T22:53:49.000Z","modified":"2026-11-14T13:12:14.412Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Go","name":"toolchain","sources":[{"name":"OSV · GO-2026-4868","url":"https://osv.dev/vulnerability/GO-2026-4868"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.25.9"},{"introduced":"1.26.0-0"},{"fixed":"1.26.2"}],"type":"SEMVER"}],"versions":[],"fixed":["1.25.9","1.26.2"]}],"sourceAffected":[],"references":["https://go.dev/cl/763765","https://go.dev/issue/78333","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"sources":[{"name":"OSV","id":"GO-2026-4868","modified":"2026-11-14T13:12:14.412102029Z","url":"https://osv.dev/vulnerability/GO-2026-4868"}],"assessments":[],"products":[],"remediation":[],"observedAt":"2026-11-14T15:05:23.349Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:15:34.962Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T01:00:33.012Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T00:45:34.987Z","attemptedAt":"2026-11-14T00:45:34.987Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T00:45:36.960Z","attemptedAt":"2026-11-14T00:45:36.960Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T00:45:34.720Z","attemptedAt":"2026-11-14T00:45:34.720Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-27143","url":"https://www.first.org/epss/","probability":0.00545,"percentile":0.46293,"date":"2026-11-13","checkedAt":"2026-11-14T00:45:34.720Z"},{"source":"GitHub Advisory Database","id":"GHSA-cfp9-33rc-j74f","url":"https://github.com/advisories/GHSA-cfp9-33rc-j74f","modified":"2026-04-13T21:30:32Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-14T00:45:34.987Z"},{"source":"ENISA EUVD","id":"EUVD-2026-20004","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20004","modified":"Apr 13, 2026, 6:20:17 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-14T00:45:36.960Z"}],"aiSummary":null}