# CVE-2025-61732: Potential code smuggling via doc comments in cmd/cgo

CVE-2025-61732 is fixed in 16 products on 2 platforms, first by Go Programming Language 1.25.7, released February 4, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-61732
- Priority: High
- CVSS: 8.6 (Important)
- EPSS: 0.0053
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 5, 2026
- Weakness: CWE-94: Improper Control of Generation of Code ('Code Injection')
- Vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-61732

## Description

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Windows apps | Go Programming Language | 1.25.7 | [Go Programming Language 1.25.7](https://patchblox.com/security/data/fix/windows-app/golang.go-1.25.7.md) | Feb 4, 2026 |
| Linux | delve RHEL 8 | 0:1.25.2-1.module+el8.10.0+23746+9db33b5e | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | delve almalinux 8 | 1.25.2-1.module_el8.10.0+4074+24330916 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | delve ol 8 | 0:1.25.2-1.0.1.module+el8.10.0+90715+2d4d8dfd | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | delve rocky 8 | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | [RLSA-2026:2708](https://patchblox.com/security/data/fix/linux/rlsa-2026-2708.md) | Feb 17, 2026 |
| Linux | go-toolset RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | go-toolset RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | go-toolset almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | go-toolset almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | go-toolset ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | go-toolset ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | go-toolset ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | go1.24 opensuse-leap 15.6 | 1.24.13-150000.1.56.1 | [SUSE-SU-2026:0426-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0426-1.md) | Feb 11, 2026 |
| Linux | go1.24 opensuse-leap 16.0 | 1.24.13-160000.1.1 | [OPENSUSE-SU-2026:20220-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20220-1.md) | Feb 13, 2026 |
| Linux | go1.24 sles 15.6 | 1.24.13-150000.1.56.1 | [SUSE-SU-2026:0426-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0426-1.md) | Feb 11, 2026 |
| Linux | go1.24 sles 15.7 | 1.24.13-150000.1.56.1 | [SUSE-SU-2026:0426-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0426-1.md) | Feb 11, 2026 |
| Linux | go1.24 sles 16.0 | 1.24.13-160000.1.1 | [SUSE-SU-2026:20429-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20429-1.md) | Feb 13, 2026 |
| Linux | go1.24-openssl opensuse-leap 15.6 | 1.24.13-150600.13.18.1 | [SUSE-SU-2026:0789-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0789-1.md) | Mar 3, 2026 |
| Linux | go1.24-openssl opensuse-leap 16.0 | 1.24.13-160000.1.1 | [OPENSUSE-SU-2026:20308-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20308-1.md) | Mar 3, 2026 |
| Linux | go1.24-openssl sles 15.6 | 1.24.13-150600.13.18.1 | [SUSE-SU-2026:0789-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0789-1.md) | Mar 3, 2026 |
| Linux | go1.24-openssl sles 15.7 | 1.24.13-150600.13.18.1 | [SUSE-SU-2026:0789-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0789-1.md) | Mar 3, 2026 |
| Linux | go1.24-openssl sles 16.0 | 1.24.13-160000.1.1 | [SUSE-SU-2026:20629-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20629-1.md) | Mar 3, 2026 |
| Linux | go1.25 opensuse-leap 15.6 | 1.25.7-150000.1.29.1 | [SUSE-SU-2026:0427-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0427-1.md) | Feb 11, 2026 |
| Linux | go1.25 opensuse-leap 16.0 | 1.25.7-160000.1.1 | [OPENSUSE-SU-2026:20214-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20214-1.md) | Feb 13, 2026 |
| Linux | go1.25 sles 15.6 | 1.25.7-150000.1.29.1 | [SUSE-SU-2026:0427-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0427-1.md) | Feb 11, 2026 |
| Linux | go1.25 sles 15.7 | 1.25.7-150000.1.29.1 | [SUSE-SU-2026:0427-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0427-1.md) | Feb 11, 2026 |
| Linux | go1.25 sles 16.0 | 1.25.7-160000.1.1 | [SUSE-SU-2026:20428-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20428-1.md) | Feb 13, 2026 |
| Linux | go1.25-openssl opensuse-leap 15.6 | 1.25.8-150600.13.15.1 | [SUSE-SU-2026:0977-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0977-1.md) | Mar 23, 2026 |
| Linux | go1.25-openssl opensuse-leap 16.0 | 1.25.12-160000.1.1 | [OPENSUSE-SU-2026:21319-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21319-1.md) | Jul 13, 2026 |
| Linux | go1.25-openssl sles 15.6 | 1.25.8-150600.13.15.1 | [SUSE-SU-2026:0977-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0977-1.md) | Mar 23, 2026 |
| Linux | go1.25-openssl sles 15.7 | 1.25.8-150600.13.15.1 | [SUSE-SU-2026:0977-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0977-1.md) | Mar 23, 2026 |
| Linux | go1.25-openssl sles 16.0 | 1.25.12-160000.1.1 | [SUSE-SU-2026:22638-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22638-1.md) | Jul 13, 2026 |
| Linux | golang RHEL 10 | 1.25.7-1.el10_0 | [RHSA-2026:3192](https://patchblox.com/security/data/fix/linux/rhsa-2026-3192.md) | Feb 5, 2026 |
| Linux | golang RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang rocky 10 | 0:1.25.7-1.el10_1 | [RLSA-2026:2706](https://patchblox.com/security/data/fix/linux/rlsa-2026-2706.md) | Feb 17, 2026 |
| Linux | golang rocky 8 | 0:1.25.7-1.module+el8.10.0+40081+47cbcb72 | [RLSA-2026:2708](https://patchblox.com/security/data/fix/linux/rlsa-2026-2708.md) | Feb 17, 2026 |
| Linux | golang rocky 9 | 0:1.25.7-1.el9_7 | [RLSA-2026:2709](https://patchblox.com/security/data/fix/linux/rlsa-2026-2709.md) | Feb 17, 2026 |
| Linux | golang-bin RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-bin RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-bin almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-bin almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-bin amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-bin ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-bin ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-bin ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-docs RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-docs RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-docs almalinux 10 | 1.25.7-1.el10_1.alma.1 | [ALSA-2026:2706](https://patchblox.com/security/data/fix/linux/alsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-docs almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-docs almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-docs amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-docs ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-docs ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-docs ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-misc RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-misc RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-misc almalinux 10 | 1.25.7-1.el10_1.alma.1 | [ALSA-2026:2706](https://patchblox.com/security/data/fix/linux/alsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-misc almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-misc almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-misc amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-misc ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-misc ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-misc ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-race RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-race RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-race almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-race almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-race ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-race ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-race ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-shared amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-src RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-src RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-src almalinux 10 | 1.25.7-1.el10_1.alma.1 | [ALSA-2026:2706](https://patchblox.com/security/data/fix/linux/alsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-src almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-src almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-src amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-src ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-src ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-src ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-tests RHEL 8 | 0:1.25.7-1.module+el8.10.0+23993+83a15e10 | [RHSA-2026:2708](https://patchblox.com/security/data/fix/linux/rhsa-2026-2708.md) | Mar 12, 2026 |
| Linux | golang-tests RHEL 9 | 0:1.25.7-1.el9_7 | [RHSA-2026:2709](https://patchblox.com/security/data/fix/linux/rhsa-2026-2709.md) | Mar 12, 2026 |
| Linux | golang-tests almalinux 10 | 1.25.7-1.el10_1.alma.1 | [ALSA-2026:2706](https://patchblox.com/security/data/fix/linux/alsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-tests almalinux 8 | 1.25.7-1.module_el8.10.0+4117+b694c6c9 | [ALSA-2026:2708](https://patchblox.com/security/data/fix/linux/alsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-tests almalinux 9 | 1.25.7-1.el9_7 | [ALSA-2026:2709](https://patchblox.com/security/data/fix/linux/alsa-2026-2709.md) | Feb 16, 2026 |
| Linux | golang-tests amzn 2023 | 1.24.13-1.amzn2023.0.1 | [ALAS2023-2026-1438](https://patchblox.com/security/data/fix/linux/alas2023-2026-1438.md) | Feb 16, 2026 |
| Linux | golang-tests ol 10 | 0:1.25.7-1.el10_1 | [ELSA-2026-2706](https://patchblox.com/security/data/fix/linux/elsa-2026-2706.md) | Feb 16, 2026 |
| Linux | golang-tests ol 8 | 0:1.25.7-1.module+el8.10.0+90804+12f38c29 | [ELSA-2026-2708](https://patchblox.com/security/data/fix/linux/elsa-2026-2708.md) | Feb 16, 2026 |
| Linux | golang-tests ol 9 | 0:1.25.7-1.el9_7 | [ELSA-2026-2709](https://patchblox.com/security/data/fix/linux/elsa-2026-2709.md) | Feb 16, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 15.6 | 0.0.20260205T172317-150000.1.146.1 | [SUSE-SU-2026:0403-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0403-1.md) | Feb 6, 2026 |
| Linux | govulncheck-vulndb opensuse-leap 16.0 | 0.0.20260723T184607-160000.1.1 | [OPENSUSE-SU-2026:21483-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21483-1.md) | Jul 30, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.