Repository navigation
cmd/compile: possible memory corruption after bound check elimination #78333
Description
Previously, slices and arrays accessed using induction variables
were sometimes incorrectly proved in-bound. If the induction variable
used for indexing were to overflow or underflow, it could allow access
to memory beyond the scope of the original slice or array.
To prevent this behavior, the compiler ensures that any mutated induction
variable that overflows/underflows with respect to its loop condition
is not used for bound check elimination.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-27143 and Go issue https://go.dev/issue/78333.
This is a PRIVATE issue for CVE-2026-27143, tracked in http://b/489466309 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3700.
/cc @golang/security and @golang/release
Activity
neild commentedon Mar 27, 2026
@gopherbot please open backport issues for this security fix
gopherbot commentedon Mar 27, 2026
Backport issue(s) opened: #78419 (for 1.25), #78420 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763546 mentions this issue:
[release-branch.go1.26] cmd/compile: fix loopbce overflow check logicgopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763553 mentions this issue:
[release-branch.go1.25] cmd/compile: fix loopbce overflow check logic[release-branch.go1.25] cmd/compile: fix loopbce overflow check logic
[release-branch.go1.26] cmd/compile: fix loopbce overflow check logic
[-]security: fix CVE-2026-27143[/-][+]cmd/compile: possible memory corruption after bound check elimination[/+]gopherbot commentedon Apr 7, 2026
Change https://go.dev/cl/763765 mentions this issue:
cmd/compile: fix loopbce overflow check logiccmd/compile: fix loopbce overflow check logic
[release-branch.go1.26] cmd/compile: fix loopbce overflow check logic
[release-branch.go1.26] cmd/compile: fix loopbce overflow check logic