CVE-2026-39824 - Vulnerability Details - OpenCVE

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Golang	Sys

No data.

No data.

References

Link	Providers
https://go.dev/cl/770080
https://go.dev/issue/78916
https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg
https://pkg.go.dev/vuln/GO-2026-5024

History

Wed, 27 May 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-680

Wed, 27 May 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Golang Golang sys
Vendors & Products		Golang Golang sys

Fri, 22 May 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-680

Fri, 22 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
Description		NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Title		Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
References		https://go.dev/cl/770080 https://go.dev/issue/78916 https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg https://pkg.go.dev/vuln/GO-2026-5024

MITRE

Status: PUBLISHED

Assigner: Go

Published: 2026-05-22T19:39:47.629Z

Updated: 2026-05-27T13:31:26.148Z

Reserved: 2026-04-07T18:13:03.527Z

Link: CVE-2026-39824

Vulnrichment

Updated: 2026-05-27T13:29:34.717Z

NVD

Status : Awaiting Analysis

Published: 2026-05-22T20:16:33.057

Modified: 2026-05-27T14:16:46.387

Link: CVE-2026-39824

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39824", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-04-07T18:13:03.527Z", "datePublished": "2026-05-22T19:39:47.629Z", "dateUpdated": "2026-05-27T13:31:26.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T19:39:47.629Z"}, "title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}], "affected": [{"vendor": "golang.org/x/sys", "product": "golang.org/x/sys/windows", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/sys/windows", "versions": [{"version": "0", "lessThan": "0.44.0", "status": "affected", "versionType": "semver"}], "platforms": ["windows"], "programRoutines": [{"name": "NewNTUnicodeString"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "references": [{"url": "https://go.dev/issue/78916"}, {"url": "https://go.dev/cl/770080"}, {"url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5024"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T13:31:22.142852Z", "id": "CVE-2026-39824", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:31:26.148Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39824", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:31:22.142852Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:29:34.717Z"}}], "cna": {"title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "affected": [{"vendor": "golang.org/x/sys", "product": "golang.org/x/sys/windows", "versions": [{"status": "affected", "version": "0", "lessThan": "0.44.0", "versionType": "semver"}], "platforms": ["windows"], "packageName": "golang.org/x/sys/windows", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "NewNTUnicodeString"}]}], "references": [{"url": "https://go.dev/issue/78916"}, {"url": "https://go.dev/cl/770080"}, {"url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5024"}], "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T19:39:47.629Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39824", "state": "PUBLISHED", "dateUpdated": "2026-05-27T13:31:26.148Z", "dateReserved": "2026-04-07T18:13:03.527Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-22T19:39:47.629Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}