Description
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
References (40)
Core 40
Core References
Patch
https://go.dev/cl/736711
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:12118
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:12282
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:13736
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:14100
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:14774
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:15091
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20088
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21691
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3556
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3559
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3855
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:4434
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5133
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5907
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5941
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5942
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5943
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5944
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5948
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5950
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5952
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:6949
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7291
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7385
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7833
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7834
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7876
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7877
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7878
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7879
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:7883
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-61731
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2434433
Issue Tracking
https://go.dev/issue/77100
Release Notes, Mailing List
https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-4339
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:17598
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:8448
Scores
CVSS v3
7.8
EPSS
0.0053
EPSS Percentile
41.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-88
Status
published
Products (3)
Go toolchain/cmd/go
< 1.24.12
Go toolchain/cmd/go
1.25.0 - 1.25.6
golang/go
< 1.24.12
Published
Jan 28, 2026
Tracked Since
Feb 18, 2026