Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-97034 · CVE overview and exploitation status

EUVD-2026-123111

GHSA-775q-r7gv-cr2x

GO-2026-6857

cve-program · CVE-2026-97034

• https://go.dev/cl/862147
• https://go.dev/issue/82576
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6857

euvd · EUVD-2026-123111

• https://go.dev/cl/862147
• https://go.dev/issue/82576
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6857

nvd · CVE-2026-97034

• https://go.dev/cl/862147
• https://go.dev/issue/82576
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6857

osv · GO-2026-6857

• https://go.dev/cl/862147
• https://go.dev/issue/82576
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM

• When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS… · Advisory content revised · 15 Nov 2026
• When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS… · Advisory content revised · 13 Nov 2026
• Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go · Newly collected advisory · 11 Nov 2026
• Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go · Newly collected advisory · 11 Nov 2026