CVE-2025-61732
Potential code smuggling via doc comments in cmd/cgo
- State
- Published
- Severity
- 8.6 High
- Published
- Feb 5, 2026
- Updated
- Sep 10, 2026
- Reserved
- Sep 30, 2025
Description
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H | CISA-ADP |
| 3.1 | 7.4 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N | redhat-SADP |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
cmd/cgoGo toolchain |
|
References
- https://go.dev/cl/734220
- https://go.dev/issue/76697
- https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
- https://pkg.go.dev/vuln/GO-2026-4433
- https://access.redhat.com/security/cve/CVE-2025-61732vdb-entry
- RHBZ#2437016issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.json
- https://access.redhat.com/errata/RHSA-2026:3192vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:2706vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:2708vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3468vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3470vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3489vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3471vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3473vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3472vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3469vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3193vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:2709vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:7385vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:7291vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:12282vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:14100vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:21691vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:15091vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:14774vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:10104vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:17598vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:8448vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:4434vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5878vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3855vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:2844vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3559vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:3556vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5948vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5950vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:5952vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.