CVE-2025-61732
Potential code smuggling via doc comments in cmd/cgo
cve-program · severity unknownEUVD CVSS 3.1 8.6 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary 8.6 HIGHCVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary 7.4 HIGHosv · severity unknownFixed by toolchain 1.24.13Fixed by toolchain 1.25.7KEV status unknown
cve-program · CVE-2025-61732
PublishedA discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Read the publisher's advisoryeuvd · EUVD-2025-206866
PublishedA discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Read the publisher's advisorynvd · CVE-2025-61732
PublishedA discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Read the publisher's advisoryosv · GO-2026-4433
PublishedA discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2025-61732 · CVE overview and exploitation status
cve-program · CVE-2025-61732
- https://go.dev/cl/734220
- https://go.dev/issue/76697
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
- https://pkg.go.dev/vuln/GO-2026-4433
euvd · EUVD-2025-206866
- https://go.dev/cl/734220
- https://go.dev/issue/76697
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
- https://pkg.go.dev/vuln/GO-2026-4433
nvd · CVE-2025-61732
- https://go.dev/cl/734220
- https://go.dev/issue/76697
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
- https://pkg.go.dev/vuln/GO-2026-4433
- https://access.redhat.com/errata/RHSA-2026:10104
- https://access.redhat.com/errata/RHSA-2026:12282
- https://access.redhat.com/errata/RHSA-2026:14100
- https://access.redhat.com/errata/RHSA-2026:14774
- https://access.redhat.com/errata/RHSA-2026:15091
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:21691
- https://access.redhat.com/errata/RHSA-2026:2706
- https://access.redhat.com/errata/RHSA-2026:2708
- https://access.redhat.com/errata/RHSA-2026:2709
- https://access.redhat.com/errata/RHSA-2026:2844
- https://access.redhat.com/errata/RHSA-2026:3192
- https://access.redhat.com/errata/RHSA-2026:3193
- https://access.redhat.com/errata/RHSA-2026:3468
- https://access.redhat.com/errata/RHSA-2026:3469
- https://access.redhat.com/errata/RHSA-2026:3470
- https://access.redhat.com/errata/RHSA-2026:3471
- https://access.redhat.com/errata/RHSA-2026:3472
- https://access.redhat.com/errata/RHSA-2026:3473
- https://access.redhat.com/errata/RHSA-2026:3489
- https://access.redhat.com/errata/RHSA-2026:3556
- https://access.redhat.com/errata/RHSA-2026:3559
- https://access.redhat.com/errata/RHSA-2026:3855
- https://access.redhat.com/errata/RHSA-2026:4434
- https://access.redhat.com/errata/RHSA-2026:5878
- https://access.redhat.com/errata/RHSA-2026:5948
- https://access.redhat.com/errata/RHSA-2026:5950
- https://access.redhat.com/errata/RHSA-2026:5952
- https://access.redhat.com/errata/RHSA-2026:7291
- https://access.redhat.com/errata/RHSA-2026:7385
- https://access.redhat.com/errata/RHSA-2026:8448
- https://access.redhat.com/security/cve/CVE-2025-61732
- https://bugzilla.redhat.com/show_bug.cgi?id=2437016
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.json
osv · GO-2026-4433
Related changes
Linked by CVE identifier- A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. · Advisory content revised · 15 Nov 2026