CVE-2026-39824 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
An integer overflow in the Go Windows library allows attackers to cause data truncation or potential memory issues by providing oversized strings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39824?
CVE-2026-39824 is a low-severity vulnerability in golang.org/x/sys/windows, published on 22 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Weakness: CWE-190
Which versions are affected by CVE-2026-39824?
1 open source package ship an affected version, including golang.org/x/sys.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/sys Go | All versions | 0.44.0 |
Linux distribution packages (2)
keybase-client openSUSE:Leap 16.0 | All versions | 6.6.3-bp160.2.1 |
keybase-client openSUSE:Tumbleweed | All versions | 6.6.3-3.1 |
How do I fix CVE-2026-39824?
Upgrade golang.org/x/sys to 0.44.0 or later.
Is CVE-2026-39824 being exploited?
There is no known exploitation of CVE-2026-39824 in the wild and no public exploit code.
Sources
Also known as AZL-87161, AZL-87164, AZL-87215, AZL-87269, AZL-87299, AZL-98697 and 1434 more.