Vulnerability Report: GO-2026-5024
- CVE-2026-39824
- Affects: golang.org/x/sys
- Published: May 22, 2026
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Affected Packages
-
PathGo VersionsSymbols
-
before v0.44.0
Aliases
References
- https://go.dev/issue/78916
- https://go.dev/cl/770080
- https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg
- https://vuln.go.dev/ID/GO-2026-5024.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.