CVE-2025-22867: Arbitrary code execution during build on darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22867?
CVE-2025-22867 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-22867?
To mitigate CVE-2025-22867, avoid building Go modules with CGO using the affected version of Go, and update to a safer version once available.
Who is affected by CVE-2025-22867?
CVE-2025-22867 primarily affects users of the Apple version of ld when building Go modules with CGO in Go version 1.24rc2.
What causes CVE-2025-22867?
CVE-2025-22867 is caused by the misuse of @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive.
Is CVE-2025-22867 specific to certain platforms?
Yes, CVE-2025-22867 is specifically related to the Darwin platform.