Vulnerability GO-2026-4867
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
April 07, 2026 at 10:53 PM UTC
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
<1.25.9, >=1.26.0-0 <1.26.2
<1.25.9, >=1.26.0-0 <1.26.2
Summary
Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
Details
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
3 days ago
Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6848
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6848
Unknown
3 days ago
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6849
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6849
Unknown
3 days ago
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6850
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6850
Unknown
3 days ago
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6851
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6851
Unknown
3 days ago
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6852
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6852
Impacted packages
Timeline
Published
7 months ago
April 07, 2026 at 10:53 PM UTC
Last Modified
6 hours ago
November 14, 2026 at 01:12 PM UTC