Code Injection in Go programming language - CVE-2025-22867

Vulnerability identifier: #VU103933

CSH Severity: Low

CVSS v4 BT: 4.1 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-22867

CWE-ID: CWE-94

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. A local user can trigger code execution while building a Go module which contains CGO when using the Apple version of ld.

Go programming language
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Development Tools Module
openSUSE Leap
go1.24-doc
go1.24-race
go1.24

Install updates from vendor's website.

Go programming language - update to 1.24 rc.3
go1.24-doc - update to 1.24 rc3-150000.1.6.1
go1.24-race - update to 1.24 rc3-150000.1.6.1
go1.24 - update to 1.24 rc3-150000.1.6.1

• https://go.dev/cl/646996
• https://go.dev/issue/71476
• https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y
• https://pkg.go.dev/vuln/GO-2025-3428

• Multiple vulnerabilities in Go programming language
• SUSE update for go1.24