CVE-2026-39824

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

CVSS 3.3 LOWEPSS 0.1%CWE-190

Vexday Risk Score

8Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 3.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 may 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Productos afectados

golang.org/x/sys · golang.org/x/sys/windows

Referencias

https://go.dev/cl/770080 https://go.dev/issue/78916 https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg https://pkg.go.dev/vuln/GO-2026-5024