# CVE-2026-27140: Code execution vulnerability in SWIG code generation in cmd/go

CVE-2026-27140 is fixed in 17 products on 2 platforms, first by Go Programming Language 1.26.2, released April 7, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-27140
- Priority: Urgent
- CVSS: 9.8 (Critical)
- EPSS: 0.0067
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 8, 2026
- Weakness: CWE-501: Trust Boundary Violation
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27140

## Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Go Programming Language | 1.26.2 | [Go Programming Language 1.26.2](https://patchblox.com/security/data/fix/windows-app/golang.go-1.26.2.md) | Apr 7, 2026 |
| Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | delve ol 8 | 0:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | delve rocky 8 | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | [RLSA-2026:10704](https://patchblox.com/security/data/fix/linux/rlsa-2026-10704.md) | May 6, 2026 |
| Linux | go-toolset RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | go-toolset RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | go-toolset almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | go-toolset ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | go-toolset ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | go-toolset ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | go1.25 opensuse-leap 16.0 | 1.25.9-160000.1.1 | [OPENSUSE-SU-2026:20570-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20570-1.md) | Apr 20, 2026 |
| Linux | go1.25 sles 15.6 | 1.25.9-150000.1.35.1 | [SUSE-SU-2026:1321-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1321-1.md) | Apr 14, 2026 |
| Linux | go1.25 sles 15.7 | 1.25.9-150000.1.35.1 | [SUSE-SU-2026:1321-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1321-1.md) | Apr 14, 2026 |
| Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.12-160000.1.1 | [OPENSUSE-SU-2026:21319-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21319-1.md) | Jul 13, 2026 |
| Linux | go1.25-openssl sles 16.0 | 1.25.12-160000.1.1 | [SUSE-SU-2026:22638-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22638-1.md) | Jul 13, 2026 |
| Linux | go1.26 opensuse-leap 16.0 | 1.26.2-160000.1.1 | [OPENSUSE-SU-2026:20571-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20571-1.md) | Apr 20, 2026 |
| Linux | go1.26 sles 15.6 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 |
| Linux | go1.26 sles 15.7 | 1.26.2-150000.1.9.1 | [SUSE-SU-2026:1320-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-1320-1.md) | Apr 14, 2026 |
| Linux | go1.26-openssl opensuse-leap 16.0 | 1.26.4-160000.1.1 | [OPENSUSE-SU-2026:21254-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21254-1.md) | Jul 7, 2026 |
| Linux | go1.26-openssl sles 16.0 | 1.26.4-160000.1.1 | [SUSE-SU-2026:22572-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22572-1.md) | Jul 7, 2026 |
| Linux | golang RHEL 10 | 1.25.9-1.el10_0 | [RHSA-2026:16024](https://patchblox.com/security/data/fix/linux/rhsa-2026-16024.md) | Apr 8, 2026 |
| Linux | golang RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang rocky 10 | 0:1.25.9-3.el10_1 | [RLSA-2026:10217](https://patchblox.com/security/data/fix/linux/rlsa-2026-10217.md) | May 6, 2026 |
| Linux | golang rocky 8 | 0:1.25.9-1.module+el8.10.0+40168+6cb0ea60 | [RLSA-2026:10704](https://patchblox.com/security/data/fix/linux/rlsa-2026-10704.md) | May 6, 2026 |
| Linux | golang rocky 9 | 0:1.25.9-1.el9_7 | [RLSA-2026:10219](https://patchblox.com/security/data/fix/linux/rlsa-2026-10219.md) | May 6, 2026 |
| Linux | golang-1.26 Debian 14 | 1.26.2-1 | [DEBIAN-CVE-2026-27140](https://patchblox.com/security/data/fix/linux/debian-cve-2026-27140.md) | Apr 8, 2026 |
| Linux | golang-bin RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-bin RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-bin almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-bin amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-bin ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-bin ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-bin ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang-docs RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-docs RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-docs almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-docs amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-docs ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-docs ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-docs ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang-misc RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-misc RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-misc almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-misc amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-misc ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-misc ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-misc ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang-race RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-race RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-race almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-race ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-race ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-race ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang-shared amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-src RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-src RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-src almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-src amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-src ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-src ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-src ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | golang-tests RHEL 8 | 0:1.25.9-1.module+el8.10.0+24226+c418b32c | [RHSA-2026:10704](https://patchblox.com/security/data/fix/linux/rhsa-2026-10704.md) | May 15, 2026 |
| Linux | golang-tests RHEL 9 | 0:1.25.9-1.el9_7 | [RHSA-2026:10219](https://patchblox.com/security/data/fix/linux/rhsa-2026-10219.md) | May 15, 2026 |
| Linux | golang-tests almalinux 8 | 1.25.9-1.module_el8.10.0+4167+2e2e20dd | [ALSA-2026:10704](https://patchblox.com/security/data/fix/linux/alsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-tests amzn 2023 | 1.25.9-1.amzn2023.0.1 | [ALAS2023-2026-1593](https://patchblox.com/security/data/fix/linux/alas2023-2026-1593.md) | Apr 27, 2026 |
| Linux | golang-tests ol 10 | 0:1.25.9-3.el10_1 | [ELSA-2026-10217](https://patchblox.com/security/data/fix/linux/elsa-2026-10217.md) | Apr 24, 2026 |
| Linux | golang-tests ol 8 | 0:1.25.9-1.module+el8.10.0+90881+305b00ae | [ELSA-2026-10704](https://patchblox.com/security/data/fix/linux/elsa-2026-10704.md) | Apr 27, 2026 |
| Linux | golang-tests ol 9 | 0:1.25.9-1.el9_7 | [ELSA-2026-10219](https://patchblox.com/security/data/fix/linux/elsa-2026-10219.md) | Apr 24, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.