Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-97035 · CVE overview and exploitation status

EUVD-2026-123110

GHSA-6f8j-v7cw-qxpp

GO-2026-6856

cve-program · CVE-2026-97035

• https://go.dev/cl/862148
• https://go.dev/issue/82575
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6856

euvd · EUVD-2026-123110

• https://go.dev/cl/862148
• https://go.dev/issue/82575
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6856

nvd · CVE-2026-97035

• https://go.dev/cl/862148
• https://go.dev/issue/82575
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6856

osv · GO-2026-6856

• https://go.dev/cl/862148
• https://go.dev/issue/82575
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM

• When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the c… · Advisory content revised · 15 Nov 2026
• When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the c… · Advisory content revised · 13 Nov 2026
• Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go · Newly collected advisory · 11 Nov 2026
• Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go · Newly collected advisory · 11 Nov 2026