GO-2026-6853Published
Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-97038 · CVE overview and exploitation status
cve-program · CVE-2026-97038
- https://go.dev/cl/862151
- https://go.dev/issue/82572
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6853
euvd · EUVD-2026-123107
- https://go.dev/cl/862151
- https://go.dev/issue/82572
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6853
nvd · CVE-2026-97038
- https://go.dev/cl/862151
- https://go.dev/issue/82572
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6853
osv · GO-2026-6853
Related changes
Linked by CVE identifier- Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFL… · Advisory content revised · 15 Nov 2026
- Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFL… · Advisory content revised · 13 Nov 2026
- Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go · Newly collected advisory · 11 Nov 2026
- Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go · Newly collected advisory · 11 Nov 2026