CVE-2025-61732
Code Injection via Comment Parsing Flaw in Go cgo Binaries
Publication date: 2026-02-05
Last updated on: 2026-02-10
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | to 1.24.13 (exc) |
| golang | go | From 1.25.0 (inc) to 1.25.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2025-61732 is a vulnerability in the Go programming language's cmd/cgo package caused by a discrepancy in how comments are parsed between Go and C/C++ code. Specifically, documentation comments that the Go compiler ignores can contain embedded C code that the C compiler interprets and includes in the generated cgo binary. This difference in parsing semantics allows malicious code to be smuggled into the resulting binary through comments."}, {'type': 'paragraph', 'content': 'The issue arises because Go and C/C++ handle comment strings differently, enabling unintended C code injection via doc comments. This vulnerability was reported by RyotaK of GMO Flatt Security Inc. and has been addressed in Go milestone 1.26.'}] [1, 3, 4]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unintended or malicious C code to be injected into the cgo binary through specially crafted documentation comments. This code smuggling can lead to unexpected behavior or code execution within the compiled binary, potentially compromising the security and integrity of applications that use cgo.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves a discrepancy in comment parsing between Go and C/C++ compilers in the cmd/cgo package, allowing code smuggling via documentation comments. Detection would involve analyzing cgo binaries or source code for suspicious embedded C code within Go doc comments.'}, {'type': 'paragraph', 'content': 'Since the issue is related to source code parsing and compilation, network detection is not directly applicable. Instead, detection can focus on auditing source code repositories and build artifacts for unexpected C code embedded in Go documentation comments.'}, {'type': 'paragraph', 'content': 'Suggested commands include using static code analysis or searching source files for suspicious comment patterns that might contain C code. For example, you could use grep to find comment blocks that contain C code markers:'}, {'type': 'list_item', 'content': "grep -r --include='*.go' -E '/\\*.*\\*/|//.*' . | grep -i 'int |void |#include'"}, {'type': 'list_item', 'content': 'Review cgo-generated files for unexpected C code by inspecting files generated during build, typically with extensions like .c or .h, or by examining the build logs for unusual compiler invocations.'}] [1, 4]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Go environment to a version where the issue is fixed. The vulnerability is addressed starting with Go 1.26 and in Go 1.25.7 for affected earlier versions.
Specifically, upgrade to Go 1.26 or later, or at least to Go 1.25.7 if you are using versions between 1.24.13 and 1.25.7.
Additionally, ensure that your build process uses the updated cgo compiler that no longer parses user-provided doc comments, preventing code injection via this vector.
Review your source code and build artifacts for any suspicious embedded C code in documentation comments and remove or sanitize them.