CVE-2025-61732
Published: 05 February 2026
Summary
CVE-2025-61732 is a high-severity Code Injection (CWE-94) vulnerability in Golang Go. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the code injection flaw in the Go cgo compiler, preventing exploitation through timely patching.
Mandates vulnerability scanning of development environments to identify vulnerable Go versions affected by this cgo comment parsing discrepancy.
Enforces standardized secure development processes and tools, ensuring use of vetted and patched Go compilers to avoid build-time code smuggling.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables code injection via malicious Go source compilation (T1204.002) leading to execution of attacker-controlled code in resulting binary (T1203).
NVD Description
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Deeper analysisAI
CVE-2025-61732 is a code injection vulnerability (CWE-94) in the Go programming language's cgo feature, which enables calling C/C++ code from Go. The issue arises from a discrepancy in how comments are parsed between Go and C/C++, allowing malicious code to be smuggled into the resulting cgo binary during compilation. It carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and was published on 2026-02-05.
A local attacker requires no privileges but needs to trick a user into compiling Go code that uses cgo with specially crafted C/C++ comments containing smuggled code. User interaction is necessary for the compilation step, after which the resulting binary executes the injected code, achieving high impacts on confidentiality, integrity, and availability due to the changed scope.
Mitigation details are available in official Go advisories and patches, including the fix in change list https://go.dev/cl/734220, issue discussion at https://go.dev/issue/76697, announcement at https://groups.google.com/g/golang-announce/c/K09ubi9FQFk, and vulnerability entry at https://pkg.go.dev/vuln/GO-2026-4433.
Details
- CWE(s)