AZL-113399: CVE-2026-97036 affecting package gcc 13.2.0-7

Q: Who is realistically exposed to this issue?

The issue affects Darwin environments where the Go command builds a malicious package that uses cgo and invokes the Apple linker. It is a link-time risk rather than a vulnerability triggered by merely having the package present.

Q: What does an attacker need to exploit it?

An attacker needs to supply or induce the build of a malicious cgo package containing a #cgo LDFLAGS directive that passes "-l to_library <path>". The Apple linker can recombine the separated arguments and load an arbitrary LTO plugin dynamic library during linking.

Published Nov 11, 2026

Updated

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Affected Software

1 affected component

azure-linux/gcc<=13.2.0-7

Event History

Nov 11, 2026

Advisory Published

via OSV·05:19 AM

Data Sourced

via OSV·05:19 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97036

Frequently Asked Questions

Who is realistically exposed to this issue?

The issue affects Darwin environments where the Go command builds a malicious package that uses cgo and invokes the Apple linker. It is a link-time risk rather than a vulnerability triggered by merely having the package present.

What does an attacker need to exploit it?

An attacker needs to supply or induce the build of a malicious cgo package containing a #cgo LDFLAGS directive that passes "-l to_library <path>". The Apple linker can recombine the separated arguments and load an arbitrary LTO plugin dynamic library during linking.

What mitigations are available if an update cannot be applied immediately?

Avoid building untrusted Go packages that use cgo on Darwin, particularly packages with #cgo LDFLAGS directives. Review build inputs for the "-l" followed by "to_library" pattern and for the linker options "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path".

AZL-113399: CVE-2026-97036 affecting package gcc 13.2.0-7

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What mitigations are available if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What mitigations are available if an update cannot be applied immediately?