CVE-2026-97042
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Exploit likelihood
What each source reports
CVE ListNo score
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
CVE-2026-97042- Updated
- 2026-11-11
EUVDEUVD-2026-123103No score
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
EUVD-2026-123103- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-jgj7-3254-vwmvNo score
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE...
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
GHSA-jgj7-3254-vwmv- Updated
- 2026-11-11
NVDNo score
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
CVE-2026-97042- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-97042No score
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
DEBIAN-CVE-2026-97042- Updated
- 2026-11-11
OSVGO-2026-6849No score
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.
The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk.
The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
- Record
GO-2026-6849- Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12529-1No score
go1.26-1.26.11-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12529-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang-1.19Debian:12 | All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 | None known |
golang-1.24Debian:13 | All versions, plus listed versions 1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2 Show 5 moreShow less1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1 | None known |
golang-1.26Debian:14 | All versions, plus listed versions 1.26.0-11.26.1-11.26.10-11.26.10-1~bpo13+11.26.11-1 Show 23 moreShow less1.26.2-11.26.2-21.26.2-31.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26.9-11.26.9-1~bpo13+11.26~rc2-11.26~rc3-11.26~rc3-2 | None known |
golang-1.27Debian:14 | All versions, plus listed versions 1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1 Show 9 moreShow less1.27.2-11.27.2-1~bpo13+11.27.2-1~bpo13+21.27.3-11.27.3-1~bpo13+11.27.4-11.27~rc1-11.27~rc2-11.27~rc3-1 | None known |
toolchainGo | before 1.26.11, 1.27.0-0 up to 1.27.4 | 1.26.111.27.4 |
go1.26openSUSE:Tumbleweed From an advisory covering 12 CVEs | before 1.26.11-1.1 | 1.26.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | EUVD, OSV | |
| published | EUVD, NVD, OSV | |
| aliases, references | GitHub Advisories | |
| affected | OSV | |
| aliases | EUVD | |
| description, products, references | CVE List | |
| affected, aliases, description, facts, references, title | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97042 is a vulnerability with no CVSS score yet in Go Toolchain Cmd/cgo, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in toolchain 1.26.11.
References
go.dev/cl/862155
groups.google.com/g/golang-announce/c/iY8TY0wWgbM
pkg.go.dev/vuln/GO-2026-6849
nvd.nist.gov/vuln/detail/CVE-2026-97042
github.com/advisories/GHSA-jgj7-3254-vwmv
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-97042
suse.com/security/cve/CVE-2026-97033