EUVD-2026-123111

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files "specs" or ".spec". When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "cgo LDFLAGS", GCC's built-in link spec evaluates "%:includelibgomp.spec"...