CVE-2026-39824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39824", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "state": "PUBLISHED", "assignerShortName": "Go", "dateReserved": "2026-04-07T18:13:03.527Z", "datePublished": "2026-05-22T19:39:47.629Z", "dateUpdated": "2026-05-27T13:31:26.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T19:39:47.629Z"}, "title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}], "affected": [{"vendor": "golang.org/x/sys", "product": "golang.org/x/sys/windows", "collectionURL": "https://pkg.go.dev", "packageName": "golang.org/x/sys/windows", "versions": [{"version": "0", "lessThan": "0.44.0", "status": "affected", "versionType": "semver"}], "platforms": ["windows"], "programRoutines": [{"name": "NewNTUnicodeString"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "references": [{"url": "https://go.dev/issue/78916"}, {"url": "https://go.dev/cl/770080"}, {"url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5024"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T13:31:22.142852Z", "id": "CVE-2026-39824", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:31:26.148Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39824", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T13:31:22.142852Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T13:29:34.717Z"}}], "cna": {"title": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows", "affected": [{"vendor": "golang.org/x/sys", "product": "golang.org/x/sys/windows", "versions": [{"status": "affected", "version": "0", "lessThan": "0.44.0", "versionType": "semver"}], "platforms": ["windows"], "packageName": "golang.org/x/sys/windows", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "NewNTUnicodeString"}]}], "references": [{"url": "https://go.dev/issue/78916"}, {"url": "https://go.dev/cl/770080"}, {"url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"}, {"url": "https://pkg.go.dev/vuln/GO-2026-5024"}], "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-190: Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "shortName": "Go", "dateUpdated": "2026-05-22T19:39:47.629Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39824", "state": "PUBLISHED", "dateUpdated": "2026-05-27T13:31:26.148Z", "dateReserved": "2026-04-07T18:13:03.527Z", "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc", "datePublished": "2026-05-22T19:39:47.629Z", "assignerShortName": "Go"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "golang.org/x/sys/windows", "platforms": ["windows"], "product": "golang.org/x/sys/windows", "programRoutines": [{"name": "NewNTUnicodeString"}], "vendor": "golang.org/x/sys", "versions": [{"lessThan": "0.44.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@golang.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error."}, {"lang": "es", "value": "NewNTUnicodeString no comprueba el desbordamiento de longitud de cadena. Cuando se le proporciona una cadena que desborda el tama\u00f1o m\u00e1ximo de una NTUnicodeString (un n\u00famero de bytes de 16 bits), devuelve una cadena truncada en lugar de un error."}], "id": "CVE-2026-39824", "lastModified": "2026-07-23T16:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39824", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T13:31:22.142852Z", "version": "2.0.3"}}]}, "published": "2026-05-22T20:16:33.057", "references": [{"source": "security@golang.org", "url": "https://go.dev/cl/770080"}, {"source": "security@golang.org", "url": "https://go.dev/issue/78916"}, {"source": "security@golang.org", "url": "https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"}, {"source": "security@golang.org", "url": "https://pkg.go.dev/vuln/GO-2026-5024"}], "sourceIdentifier": "security@golang.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.44.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "golang.org/x/sys/windows", "source": "cna", "vendor": "golang.org/x/sys"}, "product": "sys", "vendor": "golang"}], "created": "2026-05-22T22:00:12.801401+00:00", "updated": "2026-05-27T21:45:43.178291+00:00", "vendors": ["golang", "golang$PRODUCT$sys"]}