{"id":"AZL-113399","summary":"CVE-2026-97036 affecting package gcc 13.2.0-7","details":"On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library \u003cpath\u003e\" in a \"#cgo LDFLAGS\" directive. The Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.","modified":"2026-11-13T14:17:21.864172349Z","published":"2026-11-11T05:19:57Z","upstream":["CVE-2026-97036"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97036"}],"affected":[{"package":{"name":"gcc","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/gcc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"13.2.0-7"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113399.json"}}],"schema_version":"1.9.2"}