CVE-2026-97042

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using //go:cgo import dynamic or linking against a crafted PE object on Windows can pass unsafe library arguments to the external linker. The compiler previously only validated the first character of the library name in //go:cgo import dynamic directives and skipped validation in cgo-generated files. Furthermore, on Windows, cmd/cgo and cmd/link failed to validate imported DLL names from PE object files before emitting -l<name> flags, enabling a crafted DLL name with .. path traversal or special characters to reference arbitrary files on disk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.