Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.3
CVE-2026-39824: Go Windows Library Fails to Handle String Overflow
CVE-2026-39824 · published 5 months ago
Summary
The Go Windows library doesn't properly handle strings that are too long, which could cause data loss. This affects developers who use the library to interact with Windows systems. To stay safe, update the library to the latest version.
What to do
- Update x golang.org/x/sys to version 0.44.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:18.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:20.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:22.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:22.04:LTS | canonical | google-guest-agent | All versions |
| Go | x | golang.org/x/sys |
< 0.44.0 Fix: upgrade to 0.44.0
|
| Ubuntu:16.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:24.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:24.04:LTS | canonical | google-guest-agent | All versions |
| Ubuntu:25.10 | canonical | golang-golang-x-sys | All versions |
| Ubuntu:25.10 | canonical | google-guest-agent | All versions |
| Ubuntu:26.04:LTS | canonical | golang-golang-x-sys | All versions |
| Ubuntu:26.04:LTS | canonical | google-guest-agent | All versions |
Original advisory text
Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
References
- https://www.cve.org/CVERecord?id=CVE-2026-39824 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-39824 Third Party Advisory
- https://github.com/golang/go/issues/78916 Third Party Advisory
- https://pkg.go.dev/vuln/GO-2026-5024 Third Party Advisory
- https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg Third Party Advisory
- https://go.dev/cl/770080 Third Party Advisory
- https://go.dev/issue/78916 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-190Integer Overflow
Timeline
Published22 May 2026
Updated26 Oct 2026
First seen22 May 2026
Track software like this
Free during beta