Is CVE-2026-32282 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32282 being exploited in the wild.

How severe is CVE-2026-32282?

Medium severity, with a CVSS score of 6.4, published 8 April 2026.

Which products and versions are affected?

stdlib (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2; Go Project Go standard library = 1.26.0-0 < 1.26.2.

Is there a fix for CVE-2026-32282?

Yes. stdlib (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32282 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-32282?

Check whether you run stdlib (Go) or Go Project Go standard library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32282: Go standard library symlink traversal in Root.Chmod on Linux

Q: Is there a fix for CVE-2026-32282?

Yes. stdlib (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32282 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-32282?

Check whether you run stdlib (Go) or Go Project Go standard library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32282 · Severity: medium · CVSS 6.4 · Published 2026-04-08

A vulnerability in the Go programming language's standard library could allow an attacker to modify file permissions outside of an intended directory on Linux systems. By quickly replacing a file with a symbolic link during a specific operation, an attacker could trick the system into changing the permissions of sensitive files they should not have access to. This could lead to unauthorized data access or system instability, though it requires high privileges and precise timing to execute.

Technologies: stdlib (Go). Vendors: Go, Go Project.

Quick answers

Is CVE-2026-32282 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32282 being exploited in the wild.
How severe is CVE-2026-32282?: Medium severity, with a CVSS score of 6.4, published 8 April 2026.
Which products and versions are affected?: stdlib (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2; Go Project Go standard library < 1.25.9, >= 1.26.0-0 < 1.26.2.
Is there a fix for CVE-2026-32282?: Yes. stdlib (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32282 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-32282?: Check whether you run stdlib (Go) or Go Project Go standard library at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stdlib (Go): upgrade to 1.26.2 or later
```
go get stdlib@v1.26.2
```

Technical details

A race condition exists in the Go standard library's internal/syscall/unix package on Linux. The Root.Chmod function uses the fchmodat syscall with the AT_SYMLINK_NOFOLLOW flag to prevent symlink traversal; however, the Linux kernel silently ignores this flag for fchmodat. While Go performs a pre-check to ensure the target is not a symlink, an attacker can replace the target file with a symlink between the check and the actual syscall (TOCTOU). This allows the chmod operation to be applied to a target outside the restricted root. The issue is resolved in Go 1.25.9 and 1.26.2 by using the fchmodat2 syscall or a /proc/self/fd workaround.

Affected products

Go Project Go standard library < 1.25.9, >= 1.26.0-0 < 1.26.2

Identifiers

CVE-2026-32282
GO-2026-4864

Timeline

2026-03-23: disclosed: Issue opened on Go GitHub repository
2026-04-07: advisory: Go Project published vulnerability report GO-2026-4864
2026-04-08: patched: CVE published and fixes released in Go 1.25.9 and 1.26.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.