TOOLCHAIN · CVE-2026-97040 · Runtime
FIX → 1.27.4 +1
A crafted .syso file disguised as a Go object file can smuggle cgo directives such as cgo_ldflag into the build, which are passed unvalidated to the external linker. An attacker who gets such a file into a package being built can run extra linker options, which can lead to code execution on the build machine.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go programs from third-party or untrusted packages that include .syso files, including cgo builds. Builds using only trusted source and no vendored .syso files are much less exposed. unknown whether a specific exploit path has been demonstrated.
Not affected if no-syso-files, trusted-sources-only
Who cares build-systems, cgo, ci, go
go version and compare against the fixed versions.Upgrade to 1.27.4 +1
1.26.111.27.4Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking.
When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds.
The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.