Vulnerability GO-2026-4868

Unknown

7 months ago

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

<1.25.9, >=1.26.0-0 <1.26.2

Summary

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

Details

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

3 days ago

Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6848

Unknown

3 days ago

Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6849

Unknown

3 days ago

Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6850

Unknown

3 days ago

Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6851

Unknown

3 days ago

Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6852

View all vulnerabilities for these packages

Impacted packages

toolchain

Timeline

Published

7 months ago

Last Modified

6 hours ago