CVE-2026-39824: Golang.org/x/sys Golang.org/x/sys/windows

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

Affected products

• Golang.org/x/sys Golang.org/x/sys/windows: before 0.44.0 (fixed in 0.44.0)

Published 2026-05-22. Last modified 2026-07-23.