CVE-2025-61732: Potential code smuggling via doc comments in cmd/cgo
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Other sources
Potential code smuggling via doc comments in cmd/cgo
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61732?
CVE-2025-61732 is classified as a medium severity vulnerability due to the potential for code smuggling.
How do I fix CVE-2025-61732?
To address CVE-2025-61732, update to the latest version of Go that resolves the comment parsing discrepancy.
What impact does CVE-2025-61732 have on affected software?
CVE-2025-61732 could allow an attacker to introduce malicious code into cgo binaries through improperly parsed comments.
Which versions of Go are vulnerable to CVE-2025-61732?
CVE-2025-61732 affects specific versions of Go where the comment parsing mechanism was improperly implemented.
Is CVE-2025-61732 related to Go's handling of C/C++ comments?
Yes, CVE-2025-61732 specifically involves a discrepancy in how Go and C/C++ comments are parsed, leading to a code smuggling vulnerability.