AZL-113453: CVE-2026-97042 affecting package golang 1.27.4-1
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Windows build environments that compile untrusted or malicious Go packages, or link against crafted PE object files, are exposed. The issue affects paths that invoke an external linker with library arguments derived from cgo directives or PE import metadata.
What must an attacker control to exploit it?
An attacker needs to provide a malicious package using //go:cgo_import_dynamic or a crafted PE object file with manipulated imported DLL names. The malicious name must cause the Go tooling to emit an unsafe -l<name> argument for the external linker.
How can I tell whether a build may already be affected?
Review Windows build inputs for //go:cgo_import_dynamic directives and PE object files from untrusted sources. Suspicious library or DLL names include values containing "..", path separators, ":", or names beginning with "-" or "@".
What can be done if updating is not immediately possible?
Do not build untrusted Go packages or link untrusted PE object files on Windows. Restrict build inputs to reviewed source and object files, and reject DLL or library names containing path traversal, path separators, colons, or leading "-" or "@" characters.