CVE-2026-97040: Go toolchain: Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags…

Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers ELF, Mach-O, PE, and XCOFF before falling through t...