AZL-113483: CVE-2026-97037 affecting package golang 1.27.4-1
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when they build a malicious Go package that uses cgo. The issue occurs during linking, so consuming or building untrusted source packages is the relevant risk condition.
What does an attacker need to exploit it?
An attacker needs to provide a malicious package containing cgo directives that pass crafted linker flags or linker-script file arguments through #cgo LDFLAGS. Successful exploitation can result in arbitrary code execution at link time.
Are all cgo builds affected?
The described attack relies on specific split -Wl, flag forms or linker options whose arguments can be interpreted as linker scripts, particularly with GNU ld.bfd. The updated go command restricts these argument forms and checks that affected flags do not reference linker script files.
How can teams reduce risk if they cannot update immediately?
Do not build untrusted Go packages that use cgo, and review cgo LDFLAGS in dependencies before building them. Pay particular attention to split -Wl, options, bare follow-on arguments, and flags that may reference regular files as linker scripts.