Is CVE-2025-61732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61732 being exploited in the wild.

How severe is CVE-2025-61732?

High severity, with a CVSS score of 8.6, published 5 February 2026.

Which products and versions are affected?

toolchain (Go) SEMVER:introduced=0,fixed=1.24.13,introduced=1.25.0-0,fixed=1.25.7.

Is there a fix for CVE-2025-61732?

Yes. toolchain (Go): upgrade to 1.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61732 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-61732?

Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61732: Google Go code smuggling in cgo via comment parsing discrepancy

CVE-2025-61732 · Severity: high · CVSS 8.6 · Published 2026-02-05

A vulnerability in the Go programming language's 'cgo' tool could allow malicious code to be hidden within what appears to be harmless documentation comments. If a developer builds a project containing this specially crafted code, the hidden instructions could be executed as part of the resulting application. This could lead to unauthorized data access or full system compromise during the software development and build process.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2025-61732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61732 being exploited in the wild.
How severe is CVE-2025-61732?: High severity, with a CVSS score of 8.6, published 5 February 2026.
Which products and versions are affected?: toolchain (Go) SEMVER:introduced=0,fixed=1.24.13,introduced=1.25.0-0,fixed=1.25.7.
Is there a fix for CVE-2025-61732?: Yes. toolchain (Go): upgrade to 1.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61732 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-61732?: Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.25.7 or later
```
go get toolchain@v1.25.7
```

Technical details

A code injection vulnerability exists in the cmd/cgo component of the Go standard library due to semantic differences in comment parsing between the Go compiler and the C/C++ compiler. An attacker can craft source code where certain strings are treated as harmless comments by the Go compiler but interpreted as executable code by the C compiler during the cgo translation process. This 'code smuggling' allows for the execution of arbitrary C code when the Go binary is built. The issue is triggered during the build process and typically requires a user to compile untrusted source code. Patches are available in Go versions 1.24.13 and 1.25.7.

Affected products

Google Go (golang) before 1.24.13, 1.25.0 to 1.25.6

Identifiers

CVE-2025-61732
GO-2026-4433

Timeline

2025-12-04: disclosed: Issue reported to the Go project by RyotaK
2026-02-05: advisory: Public advisory and CVE published
2026-02-05: patched: Fixed in Go 1.24.13 and 1.25.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.