CVE-2025-22867: Go Toolchain Cmd/go

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS" directive. This issue only affected go1.24rc2.

Affected products

• Go Toolchain Cmd/go: from 1.24.0-rc.2, before 1.24.0-rc.3 (fixed in 1.24.0-rc.3)

Published 2025-02-06. Last modified 2026-06-17.