CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
HighAC:H
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
HighC:H
Integrity
HighI:H
Availability
HighA:H
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Mariner, Open Source Software
7 affected products
azl3 gcc 13.2.0-7 on Azure Linux 3.0
azl3 golang 1.26.10-1 on Azure Linux 3.0
azl3 golang 1.26.11-1 on Azure Linux 3.0
azl3 golang 1.27.3-1 on Azure Linux 3.0
azl3 golang 1.27.4-1 on Azure Linux 3.0
azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0
azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
What changed
Affected products: azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.11-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 golang 1.27.4-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
14 Nov 2026 · 08:16:23 UTCAffected productsazl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0 → azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 golang 1.26.10-1 on Azure Linux 3.0, azl3 golang 1.26.11-1 on Azure Linux 3.0, azl3 golang 1.27.3-1 on Azure Linux 3.0, azl3 golang 1.27.4-1 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
13 Nov 2026 · 12:10:20 UTCPublic detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-97036
Published
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
euvd · EUVD-2026-123109
Published
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments …
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Nov 11, 2026, 3:13:16 AM
dateUpdated: Nov 11, 2026, 3:13:16 AM
1 related source bulletins · separate from aliases
WID-SEC-W-2026-4370: Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
nvd · CVE-2026-97036
Published
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments …
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.