cmd/compile vulnerabilities

Latest cmd/compile CVEs

Newest publication first

1. CVE-2026-97041 Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

   Published 2026-11-11

   High·CVSS 8.1 EPSS 0.23%

   Building a malicious package containing "//go:cgo_" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_stati...

2. CVE-2026-97042 Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.23%

   Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives a...

3. CVE-2026-97043 Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile

   Published 2026-11-11

   High·CVSS 8.1 EPSS 0.26%

   Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "cgo_gotypes.go", it quotes each "#...

4. CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile

   Published 2026-04-08

   Critical·CVSS 9.8 EPSS 0.55%

   Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

5. CVE-2026-27144 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

   Published 2026-04-08

   High·CVSS 7.1 EPSS 0.27%

   The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.