CVE-2025-61732 - Vulnerability Details - OpenCVE

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Gotoolchain	Cmd/go

No data.

No data.

References

Link	Providers
https://go.dev/cl/734220
https://go.dev/issue/76697
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
https://pkg.go.dev/vuln/GO-2026-4433

History

Thu, 05 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 05 Feb 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}`

Thu, 05 Feb 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Gotoolchain Gotoolchain cmd/go
Vendors & Products		Gotoolchain Gotoolchain cmd/go

Thu, 05 Feb 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Title		Potential code smuggling via doc comments in cmd/cgo
References		https://go.dev/cl/734220 https://go.dev/issue/76697 https://groups.google.com/g/golang-announce/c/K09ubi9FQFk https://pkg.go.dev/vuln/GO-2026-4433

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-02-05T03:42:26.392Z

Updated: 2026-02-05T14:57:44.851Z

Reserved: 2025-09-30T15:05:03.606Z

Link: CVE-2025-61732

Vulnrichment

Updated: 2026-02-05T14:53:51.558Z

NVD

Status : Awaiting Analysis

Published: 2026-02-05T04:15:50.873

Modified: 2026-02-05T15:16:06.870

Link: CVE-2025-61732

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-61732", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2025-09-30T15:05:03.606Z", "datePublished": "2026-02-05T03:42:26.392Z", "dateUpdated": "2026-02-05T14:57:44.851Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-02-05T03:42:26.392Z"}, "title": "Potential code smuggling via doc comments in cmd/cgo", "descriptions": [{"lang": "en", "value": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary."}], "affected": [{"vendor": "Go toolchain", "product": "cmd/cgo", "collectionURL": "https://pkg.go.dev", "packageName": "cmd/cgo", "versions": [{"version": "0", "lessThan": "1.24.13", "status": "affected", "versionType": "semver"}, {"version": "1.25.0-0", "lessThan": "1.25.7", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "references": [{"url": "https://go.dev/cl/734220"}, {"url": "https://go.dev/issue/76697"}, {"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4433"}], "credits": [{"lang": "en", "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T14:56:35.952364Z", "id": "CVE-2025-61732", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:57:44.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61732", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-05T14:56:35.952364Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T14:53:51.558Z"}}], "cna": {"title": "Potential code smuggling via doc comments in cmd/cgo", "credits": [{"lang": "en", "value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}], "affected": [{"vendor": "Go toolchain", "product": "cmd/cgo", "versions": [{"status": "affected", "version": "0", "lessThan": "1.24.13", "versionType": "semver"}, {"status": "affected", "version": "1.25.0-0", "lessThan": "1.25.7", "versionType": "semver"}], "packageName": "cmd/cgo", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://go.dev/cl/734220"}, {"url": "https://go.dev/issue/76697"}, {"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"}, {"url": "https://pkg.go.dev/vuln/GO-2026-4433"}], "descriptions": [{"lang": "en", "value": "A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-02-05T03:42:26.392Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61732", "state": "PUBLISHED", "dateUpdated": "2026-02-05T14:57:44.851Z", "dateReserved": "2025-09-30T15:05:03.606Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-02-05T03:42:26.392Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}