Arbitrary Command Execution Vulnerability in GCC for Go Packages

CVE-2026-97034

What is CVE-2026-97034?

A vulnerability in GCC, when building malicious Go packages that utilize cgo, can lead to arbitrary command execution at link time. This occurs due to the handling of untrusted GCC spec files, specifically when linking with flags like '-fopenmp', '-fopenacc', or '-fsanitize='. The built-in link specifications can evaluate unsafe include directives, searching for spec files within system directories and the working directory, which poses a significant risk to system security. To mitigate this risk, the Go command now rejects certain directory inclusions and imposes restrictions on specific compiler flag values.

References