Arbitrary code exec via CGO LDFLAGS in Go1.24rc2 (Apple ld)
CVE-2025-22867 Published on February 6, 2025
Arbitrary code execution during build on darwin in cmd/go
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.
Vulnerability Analysis
CVE-2025-22867 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.
Products Associated with CVE-2025-22867
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go toolchain cmd/go:- Version 1.24.0-rc.2 and below 1.24.0-rc.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.