CVE-2025-61732: Potential code smuggling via doc comments in cmd/cgo

Modified

AliasesUBUNTU-CVE-2025-61732DEBIAN-CVE-2025-61732CGA-2222-8xr2-x6m8+6545 more

Published 05-02-2026Last modified 10-09-2026

Vulnerability summary

CVE-2025-61732 is a high (CVSS 8.6) Improper Control of Generation of Code vulnerability in go toolchain cmd/cgo. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 8.6, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

8.6/10

010

High · v3.1 (CVE.org)

EPSS score

0.53%

0%100%

Low · -0.01 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

05-02-2026
PublishedVulnerability first disclosed.
10-09-2026
Last modifiedVulnerability information updated.

Description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

CVSS metrics

7 scores · 7 sources · 1 version

v3.18.6

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Decrease -0.01 pp

From 0.54% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r40
actions-runner-controller< 0.13.1-r2
actions-runner-controller-fips< 0.13.1-r3
addon-resizer< 1.8.23-r13
addon-resizer-fips< 1.8.23-r15

age< 1.3.1-r2
age-fips< 1.3.1-r2
agentbeat< 9.2.4-r2
agentbeat-fips< 9.2.4-r2
amass< 5.0.1-r6
amazon-cloudwatch-agent-operator< 3.3.1-r2
amazon-cloudwatch-agent-operator-fips< 3.3.1-r3
amazon-ecs-agent< 1.101.3-r0
amazon-ecs-agent-fips< 1.101.3-r0
amazon-ecs-cni-plugins< 2024.9.0_git20260129-r2
amazon-ecs-cni-plugins-fips< 2024.9.0_git20260129-r4
amazon-eks-ami< 20260129-r2
amazon-eks-ami-fips< 20260129-r1
amazon-k8s-cni< 1.21.1-r4
amazon-k8s-cni-fips< 1.21.1-r4
amazon-k8s-cni-init< 1.21.1-r4
amazon-k8s-cni-init-fips< 1.21.1-r4
amazon-k8s-cni-init-fips-compat< 1.21.1-r5
amazon-ssm-agent< 3.3.3270.0-r5
amazon-ssm-agent-ecs-exec< 3.3.3270.0-r5
amazon-ssm-agent-ecs-exec-fips< 3.3.3270.0-r5
amazon-vpc-cni-plugins< 1.3_git20251112-r5
amazon-vpc-cni-plugins-fips< 1.3_git20251112-r6
ansible-operator< 1.42.0-r7
ansible-operator-fips< 1.42.0-r5
apache-beam-java-11-sdk< 2.71.0-r2
apache-beam-java-17-sdk< 2.71.0-r2
apache-beam-java-21-sdk< 2.71.0-r2
apache-exporter< 1.0.12-r2
apisix-ingress-controller< 2.0.1-r4
apm-server-7.17< 7.17.29-r10
apm-server-8.17< 8.17.10-r5
apm-server-8.19< 8.19.11-r1
apm-server-9.0< 9.0.8-r3
apm-server-9.1< 9.1.10-r1
apm-server-9.2< 9.2.5-r1
apm-server-fips-7.17< 7.17.29-r9
apm-server-fips-8.19< 8.19.11-r1
apm-server-fips-9.0< 9.0.8-r4
apm-server-fips-9.1< 9.1.10-r1
apm-server-fips-9.2< 9.2.5-r1
argo-cd-2.13< 2.13.9-r8
argo-cd-2.13-compat< 2.13.9-r8
argo-cd-2.14< 2.14.21-r7
argo-cd-2.14-compat< 2.14.21-r7
argo-cd-3.0< 3.0.23-r1
argo-cd-3.0-compat< 3.0.23-r1
argo-cd-3.1< 3.1.12-r2
argo-cd-3.1-compat< 3.1.12-r2
argo-cd-3.2< 3.2.6-r1
argo-cd-3.2-compat< 3.2.6-r1
argo-cd-fips-2.14< 2.14.21-r7
argo-cd-fips-2.14-compat< 2.14.21-r7
argo-cd-fips-3.0< 3.0.23-r2
argo-cd-fips-3.0-compat< 3.0.23-r2
argo-cd-fips-3.1< 3.1.12-r2
argo-cd-fips-3.1-compat< 3.1.12-r2
argo-cd-fips-3.2< 3.2.6-r2
argo-cd-fips-3.2-compat< 3.2.6-r2
argo-events< 1.9.10-r2
argo-events-fips< 1.9.10-r2
argo-rollouts< 1.8.3-r8
argo-rollouts-fips< 1.8.3-r9
argo-workflow-controller-3.6< 3.6.18-r2
argo-workflow-controller-3.7< 3.7.9-r1
argo-workflow-executor-3.6< 3.6.18-r2
argo-workflow-executor-3.7< 3.7.9-r1
argo-workflows-3.6< 3.6.18-r2
argo-workflows-3.7< 3.7.9-r1
argocd-image-updater-fips< 1.1.0-r1
atlantis< 0.40.0-r1
atlantis-fips< 0.40.0-r2
auditbeat-7< 7.17.29-r9
auditbeat-8.17< 8.17.10-r7
auditbeat-8.18< 8.18.8-r8
auditbeat-9.0< 9.0.8-r6
auditbeat-9.1< 9.1.10-r2
auditbeat-9.2< 9.2.5-r0
auditbeat-fips-7< 7.17.29-r9
auditbeat-fips-8.17< 8.17.10-r5
auditbeat-fips-8.18< 8.18.8-r5
auditbeat-fips-8.19< 8.19.11-r0
auditbeat-fips-9.0< 9.0.8-r5
auditbeat-fips-9.1< 9.1.10-r2
auditbeat-fips-9.2< 9.2.5-r0
authentik-go-server-fips< 2025.12.1-r3
authservice< 1.1.5-r3
authservice-fips< 1.1.5-r2
aws-application-networking-k8s< 2.0.0-r2
aws-application-networking-k8s-fips< 2.0.0-r2
aws-ebs-csi-driver-1.49< 1.49.2-r3
aws-ebs-csi-driver-1.50< 1.50.3-r3
aws-ebs-csi-driver-1.51< 1.51.2-r3
aws-ebs-csi-driver-1.52< 1.52.1-r4
aws-ebs-csi-driver-1.53< 1.53.0-r3
aws-ebs-csi-driver-1.54< 1.54.0-r3
aws-ebs-csi-driver-1.55< 1.55.0-r1
aws-ebs-csi-driver-fips-1.49< 1.49.2-r3
aws-ebs-csi-driver-fips-1.50< 1.50.3-r3
aws-ebs-csi-driver-fips-1.51< 1.51.2-r3
aws-ebs-csi-driver-fips-1.52< 1.52.1-r3
aws-ebs-csi-driver-fips-1.53< 1.53.0-r3
aws-ebs-csi-driver-fips-1.54< 1.54.0-r2
aws-ebs-csi-driver-fips-1.55< 1.55.0-r1
aws-efs-csi-driver< 2.3.0-r2
aws-efs-csi-driver-fips< 2.3.0-r2
aws-eks-pod-identity-agent< 0.1.36-r5
aws-eks-pod-identity-agent-fips< 0.1.36-r3
aws-flb-cloudwatch< 1.9.4-r25
aws-flb-cloudwatch-fips< 1.9.4-r20
aws-flb-firehose< 1.7.2-r24
aws-flb-firehose-fips< 1.7.2-r19
aws-flb-kinesis< 1.10.3-r6
aws-flb-kinesis-fips< 1.10.3-r7
aws-fsx-csi-driver< 1.8.0-r2
aws-fsx-csi-driver-fips< 1.8.0-r2
aws-iam-authenticator< 0.7.10-r3
aws-iam-authenticator-fips< 0.7.10-r2
aws-load-balancer-controller< 3.0.0-r1
aws-load-balancer-controller-fips< 3.0.0-r2
aws-network-policy-agent< 1.3.1-r2
aws-network-policy-agent-fips< 1.3.1-r2
aws-node-termination-handler< 1.25.4-r2
aws-node-termination-handler-fips< 1.25.4-r1
aws-otel-collector-fips< 0.47.0-r1
aws-otel-collector-healthcheck< 0.47.0-r1
aws-otel-collector-healthcheck-fips< 0.47.0-r1
aws-privateca-issuer< 1.8.0-r4
aws-privateca-issuer-fips< 1.8.0-r3
aws-s3-controller< 1.3.0-r1
aws-signer-notation-plugin< 1.0.2292-r8
aws-signer-notation-plugin-fips< 1.0.2292-r6
aws-sigv4-proxy< 1.11-r3
aws-sigv4-proxy-fips< 1.11-r2
azcopy< 10.32.0-r1
azcopy-fips< 10.32.0-r1
azure-aad-pod-identity-mic< 1.8.17-r33
azure-aad-pod-identity-nmi< 1.8.17-r33
azure-ipam< 0.4.0-r10
azure-service-operator< 2.17.0-r2
azure-service-operator-fips< 2.17.0-r2
azure-vnet-cni< 1.7.12-r2
azure-workload-identity-webhook< 1.5.1-r7
azuredisk-csi-1.28< 1.28.12-r14
azuredisk-csi-1.29< 1.29.14-r13
azuredisk-csi-1.30< 1.30.12-r11
azuredisk-csi-1.31< 1.31.12-r7
azuredisk-csi-1.32< 1.32.12-r1
azuredisk-csi-1.33< 1.33.8-r2
azuredisk-csi-1.34< 1.34.1-r1
azuredisk-csi-fips-1.28< 1.28.12-r12
azuredisk-csi-fips-1.29< 1.29.14-r12
azuredisk-csi-fips-1.30< 1.30.12-r10
azuredisk-csi-fips-1.31< 1.31.12-r7
azuredisk-csi-fips-1.32< 1.32.12-r1
azuredisk-csi-fips-1.33< 1.33.8-r2
azuredisk-csi-fips-1.34< 1.34.1-r1
azurefile-csi-1.29< 1.29.12-r11
azurefile-csi-1.30< 1.30.10-r11
azurefile-csi-1.31< 1.31.8-r7
azurefile-csi-1.32< 1.32.9-r3
azurefile-csi-1.33< 1.33.7-r2
azurefile-csi-fips-1.29< 1.29.12-r11
azurefile-csi-fips-1.30< 1.30.10-r11
azurefile-csi-fips-1.31< 1.31.8-r7
azurefile-csi-fips-1.32< 1.32.9-r2
azurefile-csi-fips-1.33< 1.33.7-r2
azurefile-csi-fips-1.34< 1.34.3-r2
backup-restore-operator-7.0< 7.0.5-r1
backup-restore-operator-8.1< 8.1.2-r1
backup-restore-operator-9.0< 9.0.1-r1
backup-restore-operator-fips-7.0< 7.0.5-r1
backup-restore-operator-fips-8.1< 8.1.2-r1
backup-restore-operator-fips-9.0< 9.0.1-r1
bank-vaults< 1.32.1-r2
bank-vaults-fips< 1.20.4-r38
bank-vaults-template< 1.32.1-r2
bank-vaults-template-fips< 1.20.4-r38
bazelisk< 1.28.1-r1
blob-csi-1.23< 1.23.11-r64
blob-csi-1.24< 1.24.11-r13
blob-csi-1.25< 1.25.10-r9
blob-csi-1.26< 1.26.9-r2
blob-csi-1.27< 1.27.2-r1
blob-csi-fips-1.23< 1.23.11-r65
blob-csi-fips-1.24< 1.24.11-r13
blob-csi-fips-1.25< 1.25.10-r8
blob-csi-fips-1.26< 1.26.9-r1
blob-csi-fips-1.27< 1.27.2-r1
blobfuse2-fips< 2.4.2-r10
blobfuse2-fips-health-monitor< 2.4.2-r10
blobfuse2-health-monitor< 2.4.2-r9
bom< 0.7.1-r5

Show all 198

Alpine2 products

etcd< 3.6.8-r0
go≥ 1.25.0, < 1.25.7-r0

2 vendors · 200 products · Showing 200 of 3529

References

46 links

go.dev/cl/734220REPORTWEBFIXPatchProduct
go.dev/issue/76697REPORTWEBIssue TrackingVendor Advisory
groups.google.com/g/golang-announce/c/K09ubi9FQFkREPORTWEBMailing ListRelease Notes
pkg.go.dev/vuln/GO-2026-4433REPORTWEBPatchVendor Advisory
access.redhat.com/security/cve/CVE-2025-61732VDB EntryX Refsource REDHATAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2437016Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61732.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:3192Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:2706Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:2708Vendor AdvisoryX Refsource REDHATAdvisory

Show all 46 references

access.redhat.com/errata/RHSA-2026:3468Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3470Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3489Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3471Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3473Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3472Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3469Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3193Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:2709Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:7385Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:7291Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:12282Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:14100Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:21691Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:15091Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:14774Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:10104Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:17598Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:8448Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:4434Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:5878Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3855Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:2844Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3559Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:3556Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:5948Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:5950Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:5952Vendor AdvisoryX Refsource REDHATAdvisory
ubuntu.com/security/CVE-2025-61732REPORT
www.cve.org/CVERecord?id=CVE-2025-61732REPORT
security-tracker.debian.org/tracker/CVE-2025-61732Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61732.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-61732AdvisoryOval
www.suse.com/security/cve/CVE-2025-61732WEB
security.alpinelinux.org/vuln/CVE-2025-61732Advisory