CVE-2026-39817

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem, potentially allowing an attacker to create or modify files in unintended locations.

This vulnerability is evaluated as having Moderate severity because the pack tool in the Go toolchain is an internal utility primarily invoked by the compiler during standard builds rather than as a general-purpose archive unpacker. Exploiting this issue requires local user interaction, specifically convincing a user or build pipeline to unpack an untrusted archive directly with this helper. While successful exploitation can result in unauthorized file modification on the host, the tool is not exposed as a network service or routinely used for unpacking external archives in Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.