This vulnerability arises from a parsing discrepancy between Go and C/C++ comments in the cmd/cgo tool, enabling code injection via comment-based code smuggling into the resulting cgo binary. An attacker could exploit this to embed and execute arbitrary code during the build process of Go modules that use cgo. The issue primarily affects systems compiling untrusted Go code with cgo, potentially leading to significant system compromise. Red Hat has issued an important security advisory and released patches in golang 1.25.7 to address this vulnerability.

Successful exploitation allows an attacker to inject and execute arbitrary code within the compiled cgo binary, leading to high confidentiality, integrity, and availability impacts. This could result in significant system compromise on affected systems where untrusted Go modules using cgo are built. The CVSS v3.1 base score is 8.6 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Red Hat rates the impact as Important for their products.

A security update fixing this vulnerability is available in golang version 1.25.7 and later. Users of affected Red Hat Enterprise Linux and OpenShift Container Platform versions should apply the provided patches promptly. Refer to the Red Hat advisory RHSA-2026:3192 for detailed update instructions. No alternative mitigations are specified by the vendor; applying the official fix is the recommended action.