CVE-2026-97038 Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go

What is CVE-2026-97038?

CVE-2026-97038 is a vulnerability in cmd/go, published on 11 Nov 2026.

Official description

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.

Which versions are affected by CVE-2026-97038?

1 open source package ship an affected version, including toolchain.

How do I fix CVE-2026-97038?

Upgrade toolchain to a fixed version for your release line: 1.26.11 or 1.27.4.

Is CVE-2026-97038 being exploited?

There is no known exploitation of CVE-2026-97038 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-97038, DEBIAN-CVE-2026-97038, GHSA-q9p5-q4jx-v656, GO-2026-6853, UBUNTU-CVE-2026-97038.