Description
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Published: 2026-02-05
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10104 cve-icon
https://access.redhat.com/errata/RHSA-2026:12282 cve-icon
https://access.redhat.com/errata/RHSA-2026:14100 cve-icon
https://access.redhat.com/errata/RHSA-2026:14774 cve-icon
https://access.redhat.com/errata/RHSA-2026:15091 cve-icon
https://access.redhat.com/errata/RHSA-2026:17598 cve-icon
https://access.redhat.com/errata/RHSA-2026:21691 cve-icon
https://access.redhat.com/errata/RHSA-2026:2706 cve-icon
https://access.redhat.com/errata/RHSA-2026:2708 cve-icon
https://access.redhat.com/errata/RHSA-2026:2709 cve-icon
https://access.redhat.com/errata/RHSA-2026:2844 cve-icon
https://access.redhat.com/errata/RHSA-2026:3192 cve-icon
https://access.redhat.com/errata/RHSA-2026:3193 cve-icon
https://access.redhat.com/errata/RHSA-2026:3468 cve-icon
https://access.redhat.com/errata/RHSA-2026:3469 cve-icon
https://access.redhat.com/errata/RHSA-2026:3470 cve-icon
https://access.redhat.com/errata/RHSA-2026:3471 cve-icon
https://access.redhat.com/errata/RHSA-2026:3472 cve-icon
https://access.redhat.com/errata/RHSA-2026:3473 cve-icon
https://access.redhat.com/errata/RHSA-2026:3489 cve-icon
https://access.redhat.com/errata/RHSA-2026:3556 cve-icon
https://access.redhat.com/errata/RHSA-2026:3559 cve-icon
https://access.redhat.com/errata/RHSA-2026:3855 cve-icon
https://access.redhat.com/errata/RHSA-2026:4434 cve-icon
https://access.redhat.com/errata/RHSA-2026:5878 cve-icon
https://access.redhat.com/errata/RHSA-2026:5948 cve-icon
https://access.redhat.com/errata/RHSA-2026:5950 cve-icon
https://access.redhat.com/errata/RHSA-2026:5952 cve-icon
https://access.redhat.com/errata/RHSA-2026:7291 cve-icon
https://access.redhat.com/errata/RHSA-2026:7385 cve-icon
https://access.redhat.com/errata/RHSA-2026:8448 cve-icon
https://access.redhat.com/security/cve/CVE-2025-61732 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2437016 cve-icon
https://go.dev/cl/734220 cve-icon cve-icon cve-icon
https://go.dev/issue/76697 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-61732 cve-icon
https://pkg.go.dev/vuln/GO-2026-4433 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-61732 cve-icon
History

Thu, 12 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Important


Tue, 10 Feb 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go

Thu, 05 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 05 Feb 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}


Thu, 05 Feb 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Gotoolchain
Gotoolchain cmd/go
Vendors & Products Gotoolchain
Gotoolchain cmd/go

Thu, 05 Feb 2026 04:15:00 +0000

Type Values Removed Values Added
Description A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Title Potential code smuggling via doc comments in cmd/cgo
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-08-19T12:05:15.242Z

Reserved: 2025-09-30T15:05:03.606Z

Link: CVE-2025-61732

cve-icon Vulnrichment

Updated: 2026-08-19T12:05:15.242Z

cve-icon NVD

Status : Modified

Published: 2026-02-05T04:15:50.873

Modified: 2026-08-19T12:17:06.673

Link: CVE-2025-61732

cve-icon Redhat

Severity : Important

Publid Date: 2026-02-05T03:42:26Z

Links: CVE-2025-61732 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-02-05T11:39:04Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')