« Back to list

CVE-2026-39824

Status: Awaiting AnalysisLow (3.3)—

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-39824",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39824",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-27T13:31:22.142852Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "golang.org/x/sys",
          "product": "golang.org/x/sys/windows",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.44.0",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "windows"
          ],
          "packageName": "golang.org/x/sys/windows",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "NewNTUnicodeString"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-22T20:16:33.057",
  "references": [
    {
      "url": "https://go.dev/cl/770080",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/78916",
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg",
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2026-5024",
      "source": "security@golang.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."
    },
    {
      "lang": "es",
      "value": "NewNTUnicodeString no comprueba el desbordamiento de longitud de cadena. Cuando se le proporciona una cadena que desborda el tamaño máximo de una NTUnicodeString (un número de bytes de 16 bits), devuelve una cadena truncada en lugar de un error."
    }
  ],
  "lastModified": "2026-07-23T16:10:00.137",
  "sourceIdentifier": "security@golang.org"
}