# CVE-2025-61732: Google Go code smuggling in cgo via comment parsing discrepancy

Source: https://junglewise.ai/threats/cve-2025-61732-google-go-code-smuggling-in-cgo-via-comment-parsing-discrepancy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-61732 · Severity: high · CVSS 8.6 · Published 2026-02-05

A vulnerability in the Go programming language's 'cgo' tool could allow malicious code to be hidden within what appears to be harmless documentation comments. If a developer builds a project containing this specially crafted code, the hidden instructions could be executed as part of the resulting application. This could lead to unauthorized data access or full system compromise during the software development and build process.

Technologies: [toolchain (Go)](https://junglewise.ai/threats/technologies/toolchain). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-61732 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61732 being exploited in the wild.

**How severe is CVE-2025-61732?** High severity, with a CVSS score of 8.6, published 5 February 2026.

**Which products and versions are affected?** toolchain (Go) SEMVER:introduced=0,fixed=1.24.13,introduced=1.25.0-0,fixed=1.25.7.

**Is there a fix for CVE-2025-61732?** Yes. toolchain (Go): upgrade to 1.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61732 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-61732?** Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- toolchain (Go): upgrade to 1.25.7 or later

  ```sh
  go get toolchain@v1.25.7
  ```


## Technical details

A code injection vulnerability exists in the cmd/cgo component of the Go standard library due to semantic differences in comment parsing between the Go compiler and the C/C++ compiler. An attacker can craft source code where certain strings are treated as harmless comments by the Go compiler but interpreted as executable code by the C compiler during the cgo translation process. This 'code smuggling' allows for the execution of arbitrary C code when the Go binary is built. The issue is triggered during the build process and typically requires a user to compile untrusted source code. Patches are available in Go versions 1.24.13 and 1.25.7.

## Affected products

- Google Go (golang) before 1.24.13, 1.25.0 to 1.25.6

## Identifiers

- CVE-2025-61732
- GO-2026-4433

## Timeline

- 2025-12-04: disclosed: Issue reported to the Go project by RyotaK
- 2026-02-05: advisory: Public advisory and CVE published
- 2026-02-05: patched: Fixed in Go 1.24.13 and 1.25.7

## References

- [https://pkg.go.dev/](https://pkg.go.dev/)
- [https://go.dev/cl/734220](https://go.dev/cl/734220)
- [https://go.dev/issue/76697](https://go.dev/issue/76697)
- [https://groups.google.com/g/golang-announce/c/K09ubi9FQFk](https://groups.google.com/g/golang-announce/c/K09ubi9FQFk)
- [https://pkg.go.dev/vuln/GO-2026-4433](https://pkg.go.dev/vuln/GO-2026-4433)
- [https://access.redhat.com/errata/RHSA-2026:10104](https://access.redhat.com/errata/RHSA-2026:10104)
- [https://access.redhat.com/errata/RHSA-2026:12282](https://access.redhat.com/errata/RHSA-2026:12282)

## Related threats

- [Go cgo LDFLAGS validation bypass in cmd/cgo](https://junglewise.ai/threats/cve-2026-97043-building-a-malicious-package-that-uses-cgo-could-bypass-cgo)
- [Go compiler unsafe library path validation in Windows linker](https://junglewise.ai/threats/cve-2026-97042-building-a-malicious-package-that-uses-go-cgo-import-dynamic-or)
- [Go compiler cgo linker flag injection via directives](https://junglewise.ai/threats/cve-2026-97041-building-a-malicious-package-containing-go-cgo-compiler)
- [Go linker arbitrary flag injection via crafted .syso files](https://junglewise.ai/threats/cve-2026-97040-building-a-package-containing-a-crafted-syso-file-could-bypass)
- [Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives)