AZL-113387: CVE-2026-97038 affecting package gcc 13.2.0-7
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LCLINKEROPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LCLINKEROPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Build environments that compile Go code using cgo or that process untrusted packages containing .syso files or linker inputs are exposed. The risk is during linking, where malicious inputs can cause arbitrary linker flags to be injected or arbitrary code to execute.
What must an attacker control to exploit it?
An attacker needs to supply a malicious package or linker input that is consumed by the Go build process. Relevant inputs include .syso files, direct object or library inputs in #cgo LDFLAGS, and libraries found in -L directories.
Are ordinary linker libraries in -L directories relevant?
Yes. Libraries resolved from -L directories could be used to deliver malicious linker scripts, embedded linker options, or LTO intermediate-representation content. The updated go command validates libraries in these directories before passing them to the external linker.
How can teams reduce exposure if they cannot update immediately?
Do not build untrusted Go packages or accept unreviewed .syso files, cgo linker inputs, or libraries from -L directories. Restrict build inputs to trusted binary objects and archives, and avoid -l forms that reference filenames or include colons, equals signs, or path separators.