CVE-2025-61732 is a code injection vulnerability (CWE-94) in the Go toolchain's cmd/cgo component caused by inconsistent parsing of comments between Go and C/C++. This discrepancy enables malicious code to be smuggled into the compiled cgo binary, potentially leading to complete compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.6 (high severity) with local attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. Red Hat OpenShift Container Platform 4.19 and related container images are affected. Red Hat has released OpenShift Container Platform 4.19.27 with security updates to fix this vulnerability. The vendor advisory RHSA-2026:5878 provides detailed upgrade instructions and image digests for affected architectures.

Successful exploitation of this vulnerability allows an attacker to inject arbitrary code into the cgo binary, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires local access with user interaction but no privileges, and it affects the Red Hat OpenShift Container Platform 4.19 and associated container images. The impact is rated high with a CVSS score of 8.6.

Red Hat has released security updates in OpenShift Container Platform 4.19.27 to address CVE-2025-61732. Users should upgrade to this version or later as soon as it is available in their release channel. Detailed upgrade instructions are provided by Red Hat at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. No alternative mitigations are indicated in the vendor advisory; applying the official update is the recommended remediation.