Vulnerability in Go Compiler and Linker Allows Unsafe Library Arguments on Windows

CVE-2026-97042

What is CVE-2026-97042?

A security vulnerability exists in the Go programming language's compiler and linker on Windows, where malicious packages could utilize the '//go:cgo_import_dynamic' directive or malformed PE objects to pass unsafe library arguments. The initial implementation only validated the first character of library names, allowing attackers to exploit this oversight through crafted DLL names that incorporate path traversal sequences or special characters. This could lead to the external linker referencing arbitrary files on disk. The issue has been addressed by enhancing the validation process, ensuring that every character in library names is checked, and preventing any usage of path traversal, leading characters like '-' or '@', and any separators within imported DLL names.

References