CVE-2026-39824: Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
Other sources
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.0-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39824?
The severity of CVE-2026-39824 is rated at 23, indicating a significant risk due to the integer overflow vulnerability.
How do I fix CVE-2026-39824?
To fix CVE-2026-39824, update the golang.org/x/sys/windows package to the latest version where the integer overflow issue is addressed.
What systems are affected by CVE-2026-39824?
CVE-2026-39824 affects applications that use the golang.org/x/sys/windows package, particularly those invoking NewNTUnicodeString without proper input validation.
What is the impact of CVE-2026-39824?
The impact of CVE-2026-39824 can lead to string truncation which may result in unexpected behavior or security issues in affected applications.
Is CVE-2026-39824 being actively exploited?
As of now, there are no reported active exploits for CVE-2026-39824, but its presence poses a risk that should be mitigated promptly.