The Go compiler incorrectly processes array copy operations when wrapped with a no‑op interface conversion. This miscompilation causes the compiler to assume non‑overlapping memory moves when it should not, leading to potential memory corruption at runtime. The flaw is classified as CWE‑440 and CWE‑843, indicating an untrusted write to memory and an improper type conversion that could lead to memory corruption.

The vulnerability affects the Go toolchain component cmd/compile in all versions prior to the fix referenced in Go issue 78371. No specific affected version list is provided, so any unpatched Go installations using cmd/compile are potentially at risk. The vulnerability is not confined to a particular platform; it applies wherever the Go compiler runs.

The CVSS score of 7.1 marks this issue as high severity, yet the EPSS score of less than 1% indicates a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widely available exploits. The likely attack path involves an adversary compiling malicious Go code or gaining influence over the compilation of trusted code, causing the resulting binary to have corrupted memory. An attacker could potentially leverage this to achieve arbitrary code execution or other destructive behavior, though the precise exploitation chain is not detailed in the advisory.