Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Sat, 14 Nov 2026 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 CWE-94 |
Sat, 14 Nov 2026 03:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 CWE-94 |
Fri, 13 Nov 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Thu, 12 Nov 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 |
Wed, 11 Nov 2026 03:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names. | |
| Title | Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Go
Published: 2026-11-11T03:13:15.477Z
Updated: 2026-11-11T03:13:15.477Z
Reserved: 2026-09-23T23:05:04.987Z
Link: CVE-2026-97040
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-11T05:19:58.283
Modified: 2026-11-12T22:09:39.233
Link: CVE-2026-97040
Redhat
No data.