CVE-2025-61732: Potential code smuggling via doc comments in cmd/cgo
Published Feb 5, 2026
·Updated
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Affected Software
3 affected components
golang/go
Golang Go<1.24.13
Golang Go>=1.25.0<1.25.7
Remediation
Patch Available
Patch Available
Event History
Feb 5, 2026
CVE Published
via MITRE·03:42 AM
Data Sourced
via MITRE·03:42 AM
DescriptionWeakness
Data Sourced
via NVD·04:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·05:01 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-61732?
CVE-2025-61732 is classified as a medium severity vulnerability due to the potential for code smuggling.
2
How do I fix CVE-2025-61732?
To address CVE-2025-61732, update to the latest version of Go that resolves the comment parsing discrepancy.
3
What impact does CVE-2025-61732 have on affected software?
CVE-2025-61732 could allow an attacker to introduce malicious code into cgo binaries through improperly parsed comments.
4
Which versions of Go are vulnerable to CVE-2025-61732?
CVE-2025-61732 affects specific versions of Go where the comment parsing mechanism was improperly implemented.
5
Is CVE-2025-61732 related to Go's handling of C/C++ comments?
Yes, CVE-2025-61732 specifically involves a discrepancy in how Go and C/C++ comments are parsed, leading to a code smuggling vulnerability.