AZL-113438: CVE-2026-97036 affecting package golang 1.26.11-1
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects builds on Darwin that process a malicious package using cgo. The risk occurs during linking with the Apple linker, rather than from merely having the golang package installed.
What must an attacker control to exploit it?
An attacker needs to provide or cause a build to use a malicious cgo package containing a #cgo LDFLAGS directive. The directive uses a separated "-l to_library <path>" argument sequence that the Apple linker recombines and uses to load an LTO plugin library.
What mitigations are available if updating is not immediately possible?
Avoid building untrusted or unreviewed cgo-enabled packages on Darwin, especially packages that supply custom #cgo LDFLAGS. Review build dependencies for the affected linker flag sequence and related Apple linker options identified in the advisory.