CVE-2025-61732 affects the cmd/cgo tool in the Go programming language toolchain. The vulnerability is caused by a difference in how Go and C/C++ comments are parsed, which enables an attacker to embed malicious code inside comments that are then smuggled into the compiled cgo binary. This flaw can be exploited when building untrusted Go modules that use cgo, potentially allowing arbitrary code execution and system compromise. The issue impacts Red Hat Enterprise Linux and OpenShift Container Platform 4.19. Red Hat has released OpenShift Container Platform 4.19.27 with updated container images and RPM packages to fix this vulnerability. Detailed upgrade instructions and image digests are provided by Red Hat. The CVSS v3 base score assigned by Red Hat is 7.4 (High), reflecting network attack vector, high attack complexity, no privileges required, and high confidentiality and integrity impact.

The vulnerability allows an attacker to embed and execute arbitrary code in the compiled cgo binary by exploiting a comment parsing discrepancy. This can lead to significant system compromise on affected Red Hat OpenShift Container Platform 4.19 deployments, especially when building untrusted Go modules using cgo. The impact includes potential unauthorized code execution with high confidentiality and integrity impact. No known exploits in the wild have been reported at this time.

A fix is available in Red Hat OpenShift Container Platform version 4.19.27. Users should upgrade to this version by applying the updated container images and RPM packages as per Red Hat's official advisories. Instructions for upgrading clusters are available in the Red Hat documentation. No additional mitigations are specified beyond applying the official update. Red Hat manages remediation for this on-premise/private cloud product; users must perform the upgrade to fully mitigate the vulnerability.