CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

Published Feb 5, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Description
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:10104 cve-icon
https://access.redhat.com/errata/RHSA-2026:12282 cve-icon
https://access.redhat.com/errata/RHSA-2026:14100 cve-icon
https://access.redhat.com/errata/RHSA-2026:14774 cve-icon
https://access.redhat.com/errata/RHSA-2026:15091 cve-icon
https://access.redhat.com/errata/RHSA-2026:17598 cve-icon
https://access.redhat.com/errata/RHSA-2026:21691 cve-icon
https://access.redhat.com/errata/RHSA-2026:2706 cve-icon
https://access.redhat.com/errata/RHSA-2026:2708 cve-icon
https://access.redhat.com/errata/RHSA-2026:2709 cve-icon
https://access.redhat.com/errata/RHSA-2026:2844 cve-icon
https://access.redhat.com/errata/RHSA-2026:3192 cve-icon
https://access.redhat.com/errata/RHSA-2026:3193 cve-icon
https://access.redhat.com/errata/RHSA-2026:3468 cve-icon
https://access.redhat.com/errata/RHSA-2026:3469 cve-icon
https://access.redhat.com/errata/RHSA-2026:3470 cve-icon
https://access.redhat.com/errata/RHSA-2026:3471 cve-icon
https://access.redhat.com/errata/RHSA-2026:3472 cve-icon
https://access.redhat.com/errata/RHSA-2026:3473 cve-icon
https://access.redhat.com/errata/RHSA-2026:3489 cve-icon
https://access.redhat.com/errata/RHSA-2026:3556 cve-icon
https://access.redhat.com/errata/RHSA-2026:3559 cve-icon
https://access.redhat.com/errata/RHSA-2026:3855 cve-icon
https://access.redhat.com/errata/RHSA-2026:4434 cve-icon
https://access.redhat.com/errata/RHSA-2026:5878 cve-icon
https://access.redhat.com/errata/RHSA-2026:5948 cve-icon
https://access.redhat.com/errata/RHSA-2026:5950 cve-icon
https://access.redhat.com/errata/RHSA-2026:5952 cve-icon
https://access.redhat.com/errata/RHSA-2026:7291 cve-icon
https://access.redhat.com/errata/RHSA-2026:7385 cve-icon
https://access.redhat.com/errata/RHSA-2026:8448 cve-icon
https://access.redhat.com/security/cve/CVE-2025-61732 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2437016 cve-icon
https://go.dev/cl/734220 cve-icon cve-icon cve-icon
https://go.dev/issue/76697 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-61732 cve-icon
https://pkg.go.dev/vuln/GO-2026-4433 cve-icon cve-icon cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-61732 cve-icon
History
Type Values Removed Values Added
First Time appeared Golang
Golang go
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-94
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

Type Values Removed Values Added
First Time appeared Gotoolchain
Gotoolchain cmd/go
Vendors & Products Gotoolchain
Gotoolchain cmd/go
Type Values Removed Values Added
Description A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Title Potential code smuggling via doc comments in cmd/cgo
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 10, 2026, 12:04 PM
Reserved
Sep 30, 2025, 3:05 PM
Status
Modified
Published
Feb 5, 2026, 4:15 AM
Modified
Sep 10, 2026, 1:17 PM
Severity
Important
Public date
Feb 5, 2026, 3:42 AM