Skip to content
CVE PROGRAM SOURCE RECORD3.3 Low

CVE-2026-39824

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/sys golang.org/x/sys/windows

Default version status: unaffected

  • 0 to < 0.44.0affected

References