AZL-113417: CVE-2026-97038 affecting package golang 1.26.11-1
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LCLINKEROPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LCLINKEROPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments using the Go command are exposed when they build a package containing attacker-controlled .syso files, cgo linker inputs, or libraries resolved from -L directories. The risk applies across platforms, with platform-specific injection paths on Windows and Darwin as well as GNU ld linker-script handling.
What does an attacker need to exploit it?
An attacker needs to cause a Go build to consume malicious linker input, such as a .syso file, a direct object or library named in #cgo LDFLAGS, or a library found in a specified -L directory. Crafted inputs can supply linker options, trigger linker-script processing, or invoke LTO plugins during linking.
Are ordinary Go builds affected by default?
The described attack requires malicious linker-related build inputs. The data does not indicate that a build without .syso files, cgo linker inputs, or attacker-controlled libraries in -L directories is affected.
What protections does the updated Go command provide?
It validates .syso files, direct linker inputs, and libraries in -L directories as binary objects or archives, and rejects embedded unallowlisted .drectve directives, LC_LINKER_OPTION commands, and LTO IR sections. It also disallows -l:<filename> and -l values containing colons, equals signs, or path separators.