# CVE-2025-61731

## Summary

- **CVE ID:** CVE-2025-61731
- **Severity:** HIGH
- **CVSS Score:** 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** Jan 28, 2026
- **Last Modified:** Sep 14, 2026

## Description

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

## Affected Products

- Go toolchain — cmd/go (0)
- Go toolchain — cmd/go (1.25.0)

## References

- [CNA](https://go.dev/cl/736711)
- [CNA](https://go.dev/issue/77100)
- [CNA](https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc)
- [CNA](https://pkg.go.dev/vuln/GO-2026-4339)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2025-61731)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2434433)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61731.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5943)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5941)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6949)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7878)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7879)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7876)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7877)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7883)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7833)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7834)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5944)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5942)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7385)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7291)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12282)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14100)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21691)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:15091)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14774)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20088)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5907)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12118)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5133)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13736)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4434)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3855)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3559)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3556)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5948)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5950)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5952)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17598)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8448)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.56%
- **EPSS Percentile:** 45.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._