CVE-2026-97034 Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97034?
CVE-2026-97034 is a vulnerability in cmd/go, published on 11 Nov 2026.
Official description
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Which versions are affected by CVE-2026-97034?
1 open source package ship an affected version, including toolchain.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.26.11, 1.27.4 |
How do I fix CVE-2026-97034?
Upgrade toolchain to a fixed version for your release line: 1.26.11 or 1.27.4.
Is CVE-2026-97034 being exploited?
There is no known exploitation of CVE-2026-97034 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-97034, DEBIAN-CVE-2026-97034, GHSA-775q-r7gv-cr2x, GO-2026-6857, UBUNTU-CVE-2026-97034.