CVE-2026-97034

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.

• CWE-77

• https://go.dev/cl/862147
• https://go.dev/issue/82576
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6857

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97029Flatpak's process ID namespace separation does not prevent a…5.7
• CVE-2026-9703Grafana's data source proxy did not apply role-based access …7.1
• CVE-2026-97030A trusted template author may have previously written a vali…6.1
• CVE-2026-97031Multiple ECH outer extension references are not permitted un…7.5
• CVE-2026-97032HTTP/2 servers could end up crashing due to inadvertently mo…7.5
• CVE-2026-97033Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97035When using Clang or GCC, building a malicious package that u…
• CVE-2026-97036On Darwin, building a malicious package that uses cgo could …
• CVE-2026-97037Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97038Building a malicious package containing ".syso" files or cgo…
• CVE-2026-97039Building a malicious package that uses "#cgo pkg-config:" di…
• CVE-2026-9704A flaw was found in Keycloak. An authenticated user with low…8.8