CVE-2026-97038

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package containing .syso files or cgo linker inputs can lead to the injection of arbitrary linker flags or the execution of arbitrary code during link time. This occurs because linker input files—such as .syso files, direct object or library inputs in #cgo LDFLAGS, and libraries in -L directories—are passed to the external linker without format validation or checks for embedded linker options. This flaw allows the execution of GNU ld implicit linker scripts disguised as libraries or .syso files, the injection of unallowlisted linker flags via PE/COFF .drectve sections on Windows or Mach-O LC LINKER OPTION load commands on Darwin, and the invocation of LTO (Link Time Optimization) plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.