CVE-2026-39824

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://go.dev/cl/770080
https://go.dev/issue/78916
https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg
https://pkg.go.dev/vuln/GO-2026-5024

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-22 20:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-39824

Mitre link : CVE-2026-39824

CVE.ORG link : CVE-2026-39824

JSON object : View

Products Affected

No product.

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-39824", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39824", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:31:22.142852Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "golang.org/x/sys", "product": "golang.org/x/sys/windows", "versions": [{"status": "affected", "version": "0", "lessThan": "0.44.0", "versionType": "semver"}], "platforms": ["windows"], "packageName": "golang.org/x/sys/windows", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "NewNTUnicodeString"}]}]}], "published": "2026-05-22T20:16:33.057", "references": [{"url": "https://go.dev/cl/770080", "source": "security@golang.org"}, {"url": "https://go.dev/issue/78916", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5024", "source": "security@golang.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}, {"lang": "es", "value": "NewNTUnicodeString no comprueba el desbordamiento de longitud de cadena. Cuando se le proporciona una cadena que desborda el tama\u00f1o m\u00e1ximo de una NTUnicodeString (un n\u00famero de bytes de 16 bits), devuelve una cadena truncada en lugar de un error."}], "lastModified": "2026-07-23T16:10:00.137", "sourceIdentifier": "security@golang.org"}