Arbitrary Code Execution in Apple Linker for Go Packages

CVE-2026-97036

What is CVE-2026-97036?

This vulnerability allows the construction of a malicious package that, when processed using the Apple linker, can lead to arbitrary code execution. The root of the issue lies in the '-l to_library ' directive in the '#cgo LDFLAGS', which the Apple linker mistakenly interprets as a single argument, '-lto_library'. This misinterpretation enables the loading of unintended dynamic libraries at link time, exposing systems to potential exploitation. Recent updates to the Go command disallow specific linker flags and patterns to mitigate the risk of this vulnerability.

References