CVE-2026-97040

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description Building a package with a crafted .syso file allows the bypass of cgo flag validation to inject arbitrary linker flags during the linking process. This occurs because the linker only verifies recognized host object headers (ELF, Mach-O, PE, and XCOFF) before attempting Go object parsing. If a .syso file starts with a go object header, it is treated as a Go compiler object, enabling untrusted cgo metadata directives, such as cgo ldflag or cgo dynamic linker, to be passed to the external linker without validation. Furthermore, .syso filenames exceeding 16 bytes lose their extension during truncation in archive headers, and unrecognized .syso formats can force external linking in pure-Go builds.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.