CVE-2026-39824 PUBLISHED

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

Assigner: Go
Reserved: 07.04.2026 Published: 22.05.2026 Updated: 22.05.2026

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

Product Status

Vendor golang.org/x/sys
Product golang.org/x/sys/windows
Versions Default: unaffected
  • affected from 0 to 0.44.0 (excl.)

References

Problem Types

  • CWE-190: Integer Overflow or Wraparound