Arbitrary Linker Flag Injection Vulnerability in Go Programming Language

CVE-2026-97040

What is CVE-2026-97040?

This vulnerability arises from improper validation of crafted '.syso' files in Go packages, enabling the injection of arbitrary linker flags. When a '.syso' file begins with a Go object header, the linker fails to validate the accompanying untrusted cgo metadata directives, allowing potentially malicious commands to be executed without appropriate safeguards. Additionally, issues with truncated '.syso' filenames exacerbate the risk by leading to external linking in pure-Go builds. The Go linker has since implemented stricter checks to reject unrecognized '.syso' formats and preserve the '.syso' extension in archive member names.

References