CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
HighAC:H
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
NoneC:N
Integrity
HighI:H
Availability
HighA:H
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Mariner, Open Source Software
7 affected products
azl3 gcc 13.2.0-7 on Azure Linux 3.0
azl3 golang 1.26.10-1 on Azure Linux 3.0
azl3 golang 1.26.11-1 on Azure Linux 3.0
azl3 golang 1.27.3-1 on Azure Linux 3.0
azl3 golang 1.27.4-1 on Azure Linux 3.0
azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0
azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
What changed
Affected products: azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.11-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 golang 1.27.4-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
14 Nov 2026 · 08:16:23 UTCAffected productsazl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.11-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 golang 1.27.4-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
13 Nov 2026 · 12:10:20 UTCPublic detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-97034
Published
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
euvd · EUVD-2026-123111
Published
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS…
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Nov 11, 2026, 3:13:17 AM
dateUpdated: Nov 11, 2026, 3:13:17 AM
4 related source bulletins · separate from aliases
openSUSE-SU-2026:12540-1: go1.27-1.27.4-1.1 on GA media
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
nvd · CVE-2026-97034
Published
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS…
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.