Go Compiler Arithmetic Vulnerability in Induction Variables Allows Memory Corruption

A vulnerability exists in the Go compiler's handling of induction variables in loops. The compiler failed to properly check these variables for arithmetic underflow or overflow, which could lead to invalid memory indexing at runtime. This issue has been identified in the Go command compilation process, specifically in versions prior to 1.25.9 and between 1.26.0 and 1.26.2.

Impact

Exploitation of this vulnerability could result in memory corruption by allowing access to memory outside the bounds of arrays or slices.

Remediation

Users can upgrade to Go versions 1.26.2 or 1.25.9, both of which include the necessary fix. Instructions for downloading these versions are available on the Go website.