CVE-2026-97034

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using cgo with GCC can lead to arbitrary command execution during link time through the use of untrusted GCC spec files (specs or *.spec). This occurs when linking with -fopenmp, -fopenacc, or -fsanitize= within #cgo LDFLAGS. In these cases, GCC's built-in link spec evaluates %:include(libgomp.spec) or %:include(libsanitizer.spec) and searches for spec files in the working directory, -L directories, and sysroot directories, including subdirectories and multilib sibling directories like ../lib64.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.