CVE-2025-61732

A flaw was found in Go's 'cgo tool'. This vulnerability arises from a discrepancy in how Go and C/C++ comments are parsed, which allows for malicious code to be hidden within comments and then "smuggled" into the compiled cgo binary. An attacker could exploit this to embed and execute arbitrary code, potentially leading to significant system compromise.

This is an Important vulnerability in the cmd/cgo component of the Go toolchain. A parsing discrepancy between Go and C/C++ comments could allow for code smuggling into the resulting cgo binary. This primarily affects systems where untrusted Go modules utilizing cgo are built, impacting Red Hat Enterprise Linux and OpenShift Container Platform.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.