Code Execution Vulnerability in Go Programming Language by Google

CVE-2026-97043

What is CVE-2026-97043?

This vulnerability arises from improper handling of the '#cgo LDFLAGS' validation during the build process in the Go programming language. An attacker can create a malicious package that exploits the flaw by injecting crafted quoting within '//go:cgo_ldflag' directives. This leads to the bypassing of essential validation checks, enabling unexpected code execution at build time or potentially causing the 'go' command to panic. As a result, unsafe linker flags or unvalidated search paths may be passed to the external linker. Furthermore, the deduplication of LDFLAGS has been shown to cause a panic due to an out-of-bounds slice index, adding another layer of risk. Recent updates to the cmd/cgo, cmd/compile, and cmd/go components ensure proper handling of backslash-escaped quotes and also rectify the slice bounds checking.

References