Potential code smuggling via doc comments in cmd/cgo
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.5%
exploitation probability
0.5%top 60% of all CVEs
observed exploitation
nono source reports it
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Go toolchain · cmd/cgoReferences
https://access.redhat.com/errata/RHSA-2026:10104https://access.redhat.com/errata/RHSA-2026:12282https://access.redhat.com/errata/RHSA-2026:14100https://access.redhat.com/errata/RHSA-2026:14774https://access.redhat.com/errata/RHSA-2026:15091https://access.redhat.com/errata/RHSA-2026:17598https://access.redhat.com/errata/RHSA-2026:21691https://access.redhat.com/errata/RHSA-2026:2706https://access.redhat.com/errata/RHSA-2026:2708https://access.redhat.com/errata/RHSA-2026:2709https://access.redhat.com/errata/RHSA-2026:2844https://access.redhat.com/errata/RHSA-2026:3192