CVE-2026-27144: 
Go vulnerability analysis and mitigation

CVE-2026-27144 is a memory corruption vulnerability in the Go compiler (cmd/compile) caused by a no-op interface conversion that prevents the compiler from correctly determining non-overlapping memory moves. This flaw affects Go versions prior to 1.25.9 and versions 1.26.0 through 1.26.1. It was published on April 8, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-843 (Type Confusion) and CWE-440 (Expected Behavior Violation). The Go compiler is designed to unwrap pointers that serve as operands of a memory move operation to verify that source and destination memory regions do not overlap. However, when a no-op interface conversion wraps such a pointer, the compiler fails to unwrap it correctly, causing it to skip the overlap check and potentially emit incorrect code that corrupts memory at runtime. Exploitation requires local access with low privileges, and the flaw manifests in compiled binaries rather than the compiler itself being directly attacked — any application compiled with an affected Go toolchain version may be vulnerable (GitHub Advisory, Go Vuln DB).

Successful exploitation can result in memory corruption at runtime within applications compiled using affected Go toolchain versions, leading to high integrity and high availability impacts — including data corruption, unpredictable application behavior, and crashes. Confidentiality impact is rated as none. The scope of affected assets is broad, encompassing any binary compiled with Go versions before 1.25.9 or between 1.26.0 and 1.26.1, including widely deployed infrastructure tools and services (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (GitHub Advisory). The EPSS score is approximately 0.006% (0th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The Go project has released patched versions: Go 1.25.9 and Go 1.26.2 (and later). All applications compiled with affected Go versions (prior to 1.25.9, or 1.26.0–1.26.1) must be recompiled using a patched toolchain to remediate the vulnerability — updating the Go runtime alone is insufficient. Red Hat has issued errata for RHEL 8 (RHSA-2026:10704), RHEL 9 (RHSA-2026:10219), and RHEL 10 (RHSA-2026:10217), among others. Organizations should audit their Go toolchain versions, upgrade to a fixed release, recompile affected binaries, and test in non-production environments before deployment (GitHub Advisory, Red Hat Bugzilla, Go Vuln DB).

The Go team announced the fix via the golang-announce mailing list, and the issue was tracked publicly at go.dev/issue/78371 (golang-announce). The vulnerability was also discussed on oss-security mailing lists and picked up by Linux distribution security teams including openSUSE, Red Hat, Amazon Linux, and others, all of whom issued advisories. A technical blog post titled "When the Compiler Lies" was published shortly after disclosure, providing community-level analysis of the miscompilation behavior (ciolek.dev). The Kubernetes and cloud-native communities noted the issue in weekly digests given the widespread use of Go in that ecosystem.