AZL-113438
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113438.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113438
- Upstream
- CVE-2026-97036
- Published
- 2026-11-11T05:19:57Z
- Modified
- 2026-11-13T14:17:22Z
- Summary
- CVE-2026-97036 affecting package golang 1.26.11-1
- Details
-
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library " in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- References