CVE-2026-27143 — Compiler Optimization Removal or Modification of Security-critical Code in Toolchain CMD Compile
CWE-733 — Compiler Optimization Removal or Modification of Security-critical Code10 documents8 sources
Severity
9.8CRITICALNVD
EPSS
0.0%
top 95.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 8
Latest updateApr 13
Description
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
4VulDB▶
cmd-compile up to 1.25.8/1.26.1 on Go induction integer overflow (Nessus ID 305686 / WID-SEC-2026-1006)↗2026-04-13
OSV▶
CVE-2026-27143: Arithmetic over induction variables in loops were not correctly checked for underflow or overflow↗2026-04-08
GHSA▶
GHSA-cfp9-33rc-j74f: Arithmetic over induction variables in loops were not correctly checked for underflow or overflow↗2026-04-08