Cmd Compile CVE-2026-27143

Exploitation requires the target to compile Go source code containing malicious loop arithmetic patterns using vulnerable cmd/compile versions 1.25.0-1.25.8 or 1.26.0-1.26.1. The attack does not exploit deployed Go applications directly; instead, it weaponizes the compilation process itself. Specific prerequisites include: developers must download or depend on attacker-controlled Go source files (via direct imports, transitive dependencies in go.mod, or code copy-paste from

CVSS 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N suggests maximum exploitability, but this rating conflates attack surface semantics. The 'network vector' applies to distributing malicious source code (e.g., via open-source repositories, dependencies), not exploiting deployed services. Actual exploitation requires victim developers to download and compile attacker-controlled Go code using affected compiler versions 1.25.0-1.25.8 or 1.26.0-1.26.1. EPSS 0.01% (1st percentile) correctly reflects minimal real-world exploitation activity, as the attack requires social engineering or supply-chain insertion rather than automated scanning. No CISA KEV listing and no public POC existence further support low immediate risk. SSVC framework assessment: Exploitation status is 'none' (no observed activity), not 'automatable' (requires human compile action), technical impact is 'total' (memory corruption enables RCE in compiled binaries). Decision priority: 'Scheduled' patching for development environments rather than emergency response. Risk concentrates in CI/CD pipelines, enterprise build servers, and developer workstations using vulnerable Go versions to compile untrusted code. Standard software development without external code review faces minimal exposure.

Attacker publishes a malicious Go library to a public repository (GitHub, pkg.go.dev) containing source code with specially crafted loop constructs designed to trigger the compiler's induction variable overflow flaw. A developer using Go 1.26.1 imports this dependency (go get attacker.com/malicious-lib) and compiles their application. During compilation, cmd/compile generates invalid array indexing instructions that pass bounds checks but overflow at runtime. When the compiled application executes the vulnerable code path (e.g., processing user input through the malicious library function), out-of-bounds memory access occurs, allowing the attacker to corrupt heap structures, hijack control flow, and achieve remote code execution in the context of the running application. No public POC exists at time of analysis.