CVE-2025-61732

Description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

CVSS Metrics

• v3.1•HIGH•Score: 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.01%• Percentile: 1%

Techniques & Countermeasures

• CWE-94•Improper Control of Generation of Code ('Code Injection')

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

• go toolchain•cmd/cgo

  < 1.24.13 | ≥ 1.25.0-0, < 1.25.7

• golang•go

  < 1.24.13 | ≥ 1.25.0, < 1.25.7

• Go•toolchain

  ≥ 1.25.0-0, < 1.25.7

References (4)

• https://go.dev/cl/734220
• https://go.dev/issue/76697
• https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• https://pkg.go.dev/vuln/GO-2026-4433