CVE-2026-27144 — Expected Behavior Violation in Toolchain CMD Compile
Severity
7.1HIGHNVD
EPSS
0.0%
top 99.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 8
Latest updateApr 13
Description
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
🔴Vulnerability Details
4VulDB▶
cmd-compile up to 1.25.8/1.26.1 on Go expected behavior violation (Nessus ID 305686 / WID-SEC-2026-1006)↗2026-04-13
GHSA▶
GHSA-cqrx-3m42-5p5w: The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the↗2026-04-08
OSV▶
CVE-2026-27144: The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the↗2026-04-08
OSV
▶