The flaw arises when the Go compiler fails to correctly bounds‑check induction variables in loops, allowing an out‑of‑range index to be used during compilation. This oversight can corrupt memory inside the compiler at runtime, creating a memory corruption vulnerability. The weakness corresponds to improper bounds checking (CWE‑733).

The defect is located in the cmd/compile component of the Go toolchain. Any system compiling Go source code with a compiler that contains this flaw, regardless of the specific build or version, is potentially affected. The CNA did not list particular version ranges, so all builds using the vulnerable compiler are at risk.

The CVSS score of 9.8 indicates a severe, high‑impact flaw, while an EPSS score of < 1% suggests that exploitation is unlikely but still possible. The vulnerability is not in CISA’s KEV catalog. The most likely attack vector is local: an attacker must supply malicious source code to a compilation process running on a system that uses the affected Go toolchain. Because the weakness is in the compiler, the impact remains confined to the compilation environment but can corrupt the compiler’s own memory space.