Log in Start free

Vulnerability · Published Feb 5, 2026 · Assigned by Go

CVE-2025-61732Potential code smuggling via doc comments in cmd/cgo

High 8.6

In plain English

A high-severity code injection in cmd/cgo from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8delve1.25.2-1.module_el8.10.0+4074+24330916ALSA-2026:2708
AlmaLinux:8go-toolset1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9go-toolset1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-bin1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-bin1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-docs1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-docs1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-docs1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-misc1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-misc1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-misc1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:8golang-race1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-race1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-src1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-src1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-src1.25.7-1.el9_7ALSA-2026:2709
AlmaLinux:10golang-tests1.25.7-1.el10_1.alma.1ALSA-2026:2706
AlmaLinux:8golang-tests1.25.7-1.module_el8.10.0+4117+b694c6c9ALSA-2026:2708
AlmaLinux:9golang-tests1.25.7-1.el9_7ALSA-2026:2709
Alpine:v3.23etcd3.6.8-r0ALPINE-CVE-2025-61732
Alpine:v3.24etcd3.6.8-r0ALPINE-CVE-2025-61732
Alpine:v3.23go1.25.7-r0ALPINE-CVE-2025-61732
Alpine:v3.24go1.25.7-r0ALPINE-CVE-2025-61732
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-61732
Debian:13golang-1.24no fix listedDEBIAN-CVE-2025-61732
Gotoolchain1.24.13, 1.25.7GO-2026-4433
Rocky Linux:8delve0:1.25.2-1.module+el8.10.0+40035+ee0a7047RLSA-2026:2708
Rocky Linux:10golang0:1.25.7-1.el10_1RLSA-2026:2706
Rocky Linux:8golang0:1.25.7-1.module+el8.10.0+40081+47cbcb72RLSA-2026:2708
Rocky Linux:9golang0:1.25.7-1.el9_7RLSA-2026:2709
Ubuntu:22.04:LTSgolang-1.17no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.20no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2025-61732
Ubuntu:24.04:LTSgolang-1.21no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2025-61732
Ubuntu:24.04:LTSgolang-1.22no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-61732
Ubuntu:24.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-61732
Ubuntu:25.10golang-1.23no fix listedUBUNTU-CVE-2025-61732
Ubuntu:26.04:LTSgolang-1.23no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2025-61732
Ubuntu:24.04:LTSgolang-1.24no fix listedUBUNTU-CVE-2025-61732
Ubuntu:25.10golang-1.24no fix listedUBUNTU-CVE-2025-61732
Ubuntu:22.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2025-61732
Ubuntu:24.04:LTSgolang-1.25no fix listedUBUNTU-CVE-2025-61732
Ubuntu:25.10golang-1.25no fix listedUBUNTU-CVE-2025-61732

Affected products (as reported)

VendorProductVersions
Go toolchain cmd/cgo 0 – before 1.24.131.25.0-0 – before 1.25.7

Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References