AZL-113471: CVE-2026-97036 affecting package golang 1.27.4-1
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue applies on Darwin systems when building a malicious package that uses cgo. Builds that do not use the Apple linker or do not process attacker-controlled cgo linker flags are not described as affected.
What must an attacker control to exploit it?
An attacker needs to supply or cause a build to use a malicious cgo package containing a #cgo LDFLAGS directive with the separated arguments "-l to_library <path>". The Apple linker can recombine these into "-lto_library" and load an arbitrary LTO plugin dynamic library during linking.
How can I tell whether a build may have been vulnerable?
Review cgo-enabled packages built on Darwin for #cgo LDFLAGS containing "-l" followed by "to_library", or other linker options now rejected by the go command: "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path". Also check whether build inputs included untrusted or malicious packages.
What mitigation is available in the updated package?
The updated go command disallows "-l" followed by "to_library", rejects the listed linker flags, and checks recombined "-l" arguments against disallowed flags and patterns. Until the update is deployed, avoid building untrusted cgo packages on Darwin.