{"id":"CVE-2025-22867","aliases":["BIT-golang-2025-22867","EUVD-2025-3035","GHSA-664g-9vm2-r26f","GO-2025-3428","SUSE-SU-2025:0429-1","SUSE-SU-2025:0431-1","openSUSE-SU-2025:14735-1","openSUSE-SU-2025:14754-1"],"status":"published","title":"Arbitrary code execution during build on darwin in cmd/go","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00645,"percentile":0.51257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-02-06T00:00:00Z","modified":"2026-06-17T08:50:39Z","fixes":[{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.24.0-rc.3"],"sources":["osv"]},{"ecosystem":"Go","package":"toolchain","fixed_in":["1.24.0-rc.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"1.24.0-rc.2"},{"fixed":"1.24.0-rc.3"}]}]},{"source":"osv","ecosystem":"Go","package":"toolchain","ranges":[{"type":"SEMVER","events":[{"introduced":"1.24.0-rc.2"},{"fixed":"1.24.0-rc.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24rc3-150000.1.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24rc3-150000.1.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.24","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24rc3-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-1.1"}]}],"bundled":6}],"products":[{"vendor":"go toolchain","product":"cmd/go"}],"references":[{"url":"https://go.dev/cl/646996","tags":["web","fix"]},{"url":"https://go.dev/issue/71476","tags":["web","report"]},{"url":"https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3428","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22867"},{"url":"https://github.com/advisories/GHSA-664g-9vm2-r26f"},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250429-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24884","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250431-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1236217","tags":["report"]},{"url":"https://bugzilla.suse.com/1236801","tags":["report"]},{"url":"https://bugzilla.suse.com/1236839","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LQJSYILFTX3S2O5RES7ORQ4XSV6GWDLY/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-22867","title":"Arbitrary code execution during build on darwin in cmd/go","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-06T17:09:56.893Z","modified":"2025-02-06T21:23:25.105Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-3035","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-06T17:09:56Z","modified":"2025-02-06T21:23:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:02.906364Z"}],"ghsa":[{"id":"GHSA-664g-9vm2-r26f","title":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when...","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-06T18:31:06Z","modified":"2025-02-07T03:33:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:59:49.949775Z"}],"nvd":[{"id":"CVE-2025-22867","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-06T18:15:32.543Z","modified":"2026-06-17T08:50:39.083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:50.916773Z"}],"osv":[{"id":"BIT-golang-2025-22867","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-08T07:13:17.42Z","modified":"2025-02-08T08:11:39.466262Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3428","title":"Arbitrary code execution during build on darwin in cmd/go","description":"On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.","status":"published","published":"2025-02-06T16:54:38Z","modified":"2025-02-08T08:11:39.466262Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14735-1","title":"go1.24-1.24rc3-1.1 on GA media","description":"These are all security issues fixed in the go1.24-1.24rc3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-06T00:00:00Z","modified":"2026-02-04T04:21:22.484732Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:14754-1","title":"govulncheck-vulndb-0.0.20250207T224745-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250207T224745-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-09T00:00:00Z","modified":"2026-02-04T04:00:41.801627Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0429-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76\n  * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c\n  * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx\n\n- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n\n- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3428 CVE-2025-22867\n  * GO-2025-3447 CVE-2025-22866\n\n- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3408\n  * GO-2025-3448 GHSA-23qp-3c2m-xx6w\n  * GO-2025-3449 GHSA-mx2j-7cmv-353c\n  * GO-2025-3450 GHSA-w7wm-2425-7p2h\n  * GO-2025-3454 GHSA-mj4v-hp69-27x5\n  * GO-2025-3455 GHSA-vqv5-385r-2hf8\n\n- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3451\n\n- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2\n  * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v\n  * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg\n  * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c\n  * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2\n  * GO-2025-3437 GHSA-274v-mgcv-cm8j\n  * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58\n  * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4\n  * GO-2025-3443 GHSA-r3r4-g7hq-pq4f\n  * GO-2025-3444 CVE-2024-35177\n  * GO-2025-3445 CVE-2024-47770\n\n- Use standard RPM macros to unpack the source and populate a\n  working directory. Fixes build with RPM 4.20.\n\n- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3408\n  * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n  * GO-2025-3424 CVE-2025-24369\n  * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g\n  * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56\n","status":"published","published":"2025-02-11T14:12:30Z","modified":"2026-02-05T00:10:56.097493Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0431-1","title":"Security update for go1.24","description":"This update for go1.24 fixes the following issues:\n\n- CVE-2025-22866: Fixed timing sidechannel for P-256 on ppc64le (bsc#1236801).\n- CVE-2025-22867: Fixed arbitrary code execution during build on darwin (bsc#1236839).\n\nOther fixes:\n\n- go1.2r42 release tracking (bsc#1236217)\n","status":"published","published":"2025-02-11T14:13:46Z","modified":"2026-02-04T02:41:52.173687Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}