This vulnerability (CVE-2026-39819) affects the Go toolchain's cmd/go component, specifically the 'go bug' command. It writes temporary files using predictable filenames in the system temporary directory. An attacker with local access to this directory could exploit this by creating symbolic links with those predictable names, leading to unauthorized file modification through overwriting files pointed to by the symlinks. The CVSS score is 5.3 (medium severity), reflecting limited attack vector and required privileges. There is currently no official fix or remediation from the vendor.

An attacker with local access and low privileges to the system temporary directory could cause the 'go bug' command to overwrite arbitrary files by exploiting predictable temporary file names and symbolic link creation. This could lead to unauthorized modification of files, impacting integrity. Confidentiality impact is low, and availability is not affected. No known exploits have been reported in the wild.

There is currently no official patch or remediation available from the vendor. Users should exercise caution when running the 'go bug' command in environments where untrusted users have access to the system temporary directory. Monitor vendor advisories for updates regarding a fix or mitigation.