Home

Description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

PUBLISHED Reserved 2025-09-30 | Published 2026-02-05 | Updated 2026-02-05 | Assigner Go

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

Product status

Default status
unaffected

Any version before 1.24.13
affected

1.25.0-0 (semver) before 1.25.7
affected

Credits

RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

References

go.dev/cl/734220

go.dev/issue/76697

groups.google.com/g/golang-announce/c/K09ubi9FQFk

pkg.go.dev/vuln/GO-2026-4433

cve.org (CVE-2025-61732)

nvd.nist.gov (CVE-2025-61732)

Download JSON