CVE-2016-3958: Privilege Escalation on Windows via Malicious DLL in Syscall
Summary
CVE-2016-3958: Privilege escalation on Windows via malicious DLL in syscall. Affects stdlib across 2 version ranges.
< 1.5.4
>= 1.6.0-0, < 1.6.1
Fixed in 1.5.4 or 1.6.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. It includes various modules and functions that enable developers to perform common tasks. One of the modules in the stdlib package is 'syscall', which allows interaction with the underlying operating system. The 'LoadLibrary' function in the 'syscall' module is used to load dynamic-link libraries (DLLs) on Windows systems. However, a vulnerability in the 'LoadLibrary' function can be exploited by local users to gain elevated privileges on the system.
Vulnerability Detail
The vulnerability, identified as CVE-2016-3958, is an untrusted search path vulnerability on Windows systems. It arises from the way the 'LoadLibrary' function in the 'syscall' module handles DLL loading. When a DLL is loaded using 'LoadLibrary', the function searches for the DLL in multiple locations, including the current working directory. This behavior can be exploited by placing a malicious DLL in the current working directory and tricking a local user into executing a program that relies on the 'LoadLibrary' function. If successful, the attacker can execute arbitrary code with elevated privileges, potentially compromising the entire system.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.5.41.5.4go get stdlib@v1.5.4 -
>= 1.6.0-0, < 1.6.11.6.1go get stdlib@v1.6.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid placing any DLLs in the current working directory or ensure that the current working directory is a trusted location. Additionally, it is advised to exercise caution when executing programs from untrusted sources.
Conclusion
The CVE-2016-3958 vulnerability in the stdlib package's 'syscall' module on Windows systems allows local users to gain elevated privileges by exploiting the untrusted search path vulnerability in the 'LoadLibrary' function. To mitigate this vulnerability, it is crucial to update the stdlib package to version 1.6.1 or later. Additionally, users should exercise caution when executing programs from untrusted sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows local users to gain elevated privileges on Windows systems. If exploited, an attacker can execute arbitrary code with elevated privileges, potentially compromising the entire system.
The vulnerability affects versions 0.0.0 to 1.5.3 and 1.6.0-0 of the stdlib package. It has been fixed in version 1.5.4 and version 1.6.1.
No, this vulnerability can only be exploited by local users who have access to the system.
There are no known instances of this vulnerability being exploited in the wild.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
