# CVE-2026-97040: Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Go toolchain / cmd/go (cmd/go): ≥ 0; < 1.26.11 (affected, semver); ≥ 1.27.0-0; < 1.27.4 (affected, semver). Source: CNA: Go
- Go toolchain / cmd/link (cmd/link): ≥ 0; < 1.26.11 (affected, semver); ≥ 1.27.0-0; < 1.27.4 (affected, semver). Source: CNA: Go

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-94

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://go.dev/cl/862153 (CNA: Go)

- https://go.dev/issue/82570 (CNA: Go)

- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM (CNA: Go)

- https://pkg.go.dev/vuln/GO-2026-6851 (CNA: Go)

## Provenance

- CNA: Go: https://www.cve.org/CVERecord?id=CVE-2026-97040; retrieved 2026-11-11; source updated 2026-11-11

Revision: ed29f1d6c8656fbccdc4a90a5d3878af7ca6e4f448059dc6419f2806559c7e3e

Canonical: https://y2.dev/cve/CVE-2026-97040

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.