CVE-2026-97034
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Exploit likelihood
What each source reports
CVE ListNo score
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
CVE-2026-97034- Updated
- 2026-11-11
EUVDEUVD-2026-123111No score
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
EUVD-2026-123111- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-775q-r7gv-cr2xNo score
When using GCC, building a malicious package that uses cgo could cause arbitrary command...
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
GHSA-775q-r7gv-cr2x- Updated
- 2026-11-11
NVDNo score
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
CVE-2026-97034- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-97034No score
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
DEBIAN-CVE-2026-97034- Updated
- 2026-11-11
OSVGO-2026-6857No score
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Record
GO-2026-6857- Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12529-1No score
go1.26-1.26.11-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12529-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang-1.19Debian:12 | All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 | None known |
golang-1.24Debian:13 | All versions, plus listed versions 1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2 Show 5 moreShow less1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1 | None known |
golang-1.26Debian:14 | All versions, plus listed versions 1.26.0-11.26.1-11.26.10-11.26.10-1~bpo13+11.26.11-1 Show 23 moreShow less1.26.2-11.26.2-21.26.2-31.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26.9-11.26.9-1~bpo13+11.26~rc2-11.26~rc3-11.26~rc3-2 | None known |
golang-1.27Debian:14 | All versions, plus listed versions 1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1 Show 9 moreShow less1.27.2-11.27.2-1~bpo13+11.27.2-1~bpo13+21.27.3-11.27.3-1~bpo13+11.27.4-11.27~rc1-11.27~rc2-11.27~rc3-1 | None known |
toolchainGo | before 1.26.11, 1.27.0-0 up to 1.27.4 | 1.26.111.27.4 |
go1.26openSUSE:Tumbleweed From an advisory covering 12 CVEs | before 1.26.11-1.1 | 1.26.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | EUVD, OSV | |
| published | EUVD, NVD, OSV | |
| aliases, references | GitHub Advisories | |
| affected | OSV | |
| aliases | EUVD | |
| description, products, references | CVE List | |
| affected, aliases, description, facts, references, title | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97034 is a vulnerability with no CVSS score yet in Go Toolchain Cmd/go, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in toolchain 1.26.11.
References
go.dev/cl/862147
groups.google.com/g/golang-announce/c/iY8TY0wWgbM
pkg.go.dev/vuln/GO-2026-6857
nvd.nist.gov/vuln/detail/CVE-2026-97034
github.com/advisories/GHSA-775q-r7gv-cr2x
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-97034
suse.com/security/cve/CVE-2026-97033