AZL-113426: CVE-2026-97042 affecting package golang 1.26.11-1
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Windows build environments that compile malicious Go packages using cgo directives or link against crafted PE object files are exposed. The issue affects the build process and external linker arguments rather than a running Go application.
What does an attacker need to exploit it?
An attacker needs to cause a Windows Go build to process a malicious package containing a //go:cgo_import_dynamic directive, or to link a crafted PE object file with a malicious imported DLL name. The crafted name can include path traversal or special characters that influence the -l argument passed to the external linker.
Are cgo-generated files affected?
Yes. Validation was skipped for cgo-generated files, and the updated compiler validates library names in those files on Windows.
What input is rejected by the fix?
The fix rejects path traversal in //go:cgo_import_dynamic library names. For DLL names imported from PE objects, cmd/cgo and cmd/link reject path separators, "..", ":", and names beginning with "-" or "@".