Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go toolchain cmd/cgo

Default version status: unaffected

  • 0 to < 1.24.13affected
  • 1.25.0-0 to < 1.25.7affected

References