GO-2026-5024
Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
At a glance
- Published
- Updated
- CVE
- CVE-2026-39824
Description
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Affected packages
| Package | Versions |
|---|---|
| Go · golang.org/x/sys | introduced 0, fixed 0.44.0 |
References
- https://go.dev/issue/78916 REPORT
- https://go.dev/cl/770080 FIX
- https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |