← CVE Intelligence

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo PUBLISHED

Description (CNA)

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

Affected (CNA)

Vendor / productVersions
Go toolchain / cmd/cgoaffected 0 before 1.24.13; affected 1.25.0-0 before 1.25.7

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled `cgo` binary. An attacker could exploit this to embed and execute arbitrary code, potentially leading to significant system compromise.