Red Hat EUVD-2026-20004

This vulnerability resides in Go's cmd/compile toolchain component, specifically in the compiler's optimization passes that handle arithmetic operations over loop induction variables. Induction variables are iteration counters or derived values that change predictably across loop iterations (e.g., i++, array[i*2]). The compiler performs static analysis to optimize these patterns but failed to properly validate integer bounds, allowing signed/unsigned integer overflow or underflow conditions to pass unchecked into compiled binaries. When the flawed compiled code executes, out-of-bounds array indexing occurs, enabling memory corruption primitive attacks. The CPE identifier cpe:2.3:a:go_toolchain:cmd/compile confirms this affects the compiler itself during build-time rather than runtime libraries. Without assigned CWE classification, the vulnerability appears to combine characteristics of CWE-190 (Integer Overflow) and CWE-119 (Improper Memory Buffer Restriction). This is a supply-chain attack surface: adversaries must convince targets to compile malicious Go source code using vulnerable compiler versions, rather than directly exploiting running applications.