AZL-113392: CVE-2026-97043 affecting package gcc 13.2.0-7
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives. When "cmd/cgo" generates "cgogotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgoldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. "cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments that run the Go toolchain on untrusted or malicious packages using cgo are exposed. A crafted package can cause unexpected code execution during the build or make the go command panic.
What does an attacker need to exploit it?
The attacker needs to provide a package containing cgo directives with crafted quoting in //go:cgo_ldflag directives. The issue relies on discrepancies between how generated cgo linker-flag directives were quoted and how cmd/compile and cmd/go parsed them.
What is the immediate mitigation if the toolchain cannot be updated?
Do not build untrusted packages that use cgo, particularly in environments where build-time code execution would be impactful. Isolate builds of untrusted code because malicious linker flags or linker search paths may be passed to the external linker.
How can I tell whether the issue has been addressed in my toolchain?
The corrected toolchain properly handles backslash-escaped quotes and unquotes //go:cgo_* pragma strings using strconv.Unquote. It also fixes the slice bounds check in processCgoOutputs that could otherwise panic while deduplicating LDFLAGS.