CVE-2026-39824: Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

Awaiting analysis

AliasesUBUNTU-CVE-2026-39824CGA-22pw-w873-2qwqCGA-25q4-jp89-4qmf+1159 more

Published 22-05-2026Last modified 27-05-2026

Vulnerability summary

CVE-2026-39824 is a low (CVSS 3.3) Integer Overflow or Wraparound vulnerability in golang.org/x/sys golang.org/x/sys/windows. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 3.3, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

3.3/10

010

Low · v3.1 (CVE.org)

EPSS score

0.11%

0%100%

Low · -0.04 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 4

OPENSUSE-SU-2026:10856-1 OPENSUSE-SU-2026:21436-1 OPENSUSE-SU-2026:21483-1 CGA-76VG-6P9R-2FX2

Timeline

22-05-2026
PublishedVulnerability first disclosed.
27-05-2026
Last modifiedVulnerability information updated.

Description

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS metrics

3 scores · 3 sources · 1 version

v3.13.3

EPSS trend

Probability

0.11%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Decrease -0.04 pp

From 0.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

actionlintAll versions (No fix recorded)
addon-resizerAll versions (No fix recorded)
amazon-cloudwatch-agent-operatorAll versions (No fix recorded)
amazon-ecs-cni-pluginsAll versions (No fix recorded)
amazon-ecs-cni-plugins-fipsAll versions (No fix recorded)

amazon-eks-amiAll versions (No fix recorded)
amazon-eks-ami-fipsAll versions (No fix recorded)
amazon-k8s-cni-fipsAll versions (No fix recorded)
amazon-vpc-cni-pluginsAll versions (No fix recorded)
amazon-vpc-cni-plugins-fipsAll versions (No fix recorded)
apache-exporterAll versions (No fix recorded)
apm-server-9.1All versions (No fix recorded)
apm-server-fips-9.1All versions (No fix recorded)
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.3-compatAll versions (No fix recorded)
argo-cd-fips-3.0All versions (No fix recorded)
argo-workflows-3.6All versions (No fix recorded)
authentik-fips-2025.12All versions (No fix recorded)
authserviceAll versions (No fix recorded)
aws-ebs-csi-driver-fips-1.59All versions (No fix recorded)
aws-eks-pod-identity-agentAll versions (No fix recorded)
aws-eks-pod-identity-agent-fipsAll versions (No fix recorded)
aws-flb-cloudwatchAll versions (No fix recorded)
aws-flb-cloudwatch-fipsAll versions (No fix recorded)
aws-flb-firehoseAll versions (No fix recorded)
aws-flb-firehose-fipsAll versions (No fix recorded)
aws-flb-kinesisAll versions (No fix recorded)
aws-flb-kinesis-fipsAll versions (No fix recorded)
aws-lambda-runtime-interface-emulatorAll versions (No fix recorded)
aws-lambda-runtime-interface-emulator-fipsAll versions (No fix recorded)
aws-nukeAll versions (No fix recorded)
aws-nuke-fipsAll versions (No fix recorded)
aws-sigv4-proxyAll versions (No fix recorded)
aws-sigv4-proxy-fipsAll versions (No fix recorded)
azure-service-operator-fipsAll versions (No fix recorded)
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-fips-1.32All versions (No fix recorded)
bazeliskAll versions (No fix recorded)
calico-3.31All versions (No fix recorded)
capslockAll versions (No fix recorded)
cargobumpAll versions (No fix recorded)
cert-manager-1.18All versions (No fix recorded)
cert-manager-fips-1.18All versions (No fix recorded)
certificate-transparencyAll versions (No fix recorded)
certificate-transparency-fips-trillian-ctserverAll versions (No fix recorded)
chart-testingAll versions (No fix recorded)
chart-testing-fipsAll versions (No fix recorded)
checksecAll versions (No fix recorded)
chrony_exporterAll versions (No fix recorded)
chrony_exporter-fipsAll versions (No fix recorded)
cilium-1.16All versions (No fix recorded)
cilium-1.17All versions (No fix recorded)
cilium-1.18All versions (No fix recorded)
cilium-1.19All versions (No fix recorded)
cilium-envoy-fips-1.16All versions (No fix recorded)
cilium-envoy-fips-1.17All versions (No fix recorded)
cilium-envoy-fips-1.18All versions (No fix recorded)
cilium-fips-1.16All versions (No fix recorded)
cloud-provider-aws-1.32All versions (No fix recorded)
cloud-provider-aws-1.34All versions (No fix recorded)
cloud-provider-aws-fips-1.34All versions (No fix recorded)
cloud-provider-azure-1.35All versions (No fix recorded)
cloud-provider-azure-fips-1.33All versions (No fix recorded)
cloud-provider-gcp-cloud-controller-managerAll versions (No fix recorded)
cloud-provider-gcp-cloud-controller-manager-fipsAll versions (No fix recorded)
cloud-provider-vsphereAll versions (No fix recorded)
cluster-api-1.12-clusterctlAll versions (No fix recorded)
cni-pluginsAll versions (No fix recorded)
cni-plugins-fipsAll versions (No fix recorded)
commercial-chainloop-backendAll versions (No fix recorded)
commercial-chainloop-cliAll versions (No fix recorded)
commercial-expanso-edgeAll versions (No fix recorded)
commercial-grafana-11.6All versions (No fix recorded)
commercial-grafana-12.1All versions (No fix recorded)
commercial-grafana-12.2All versions (No fix recorded)
commercial-grafana-12.3All versions (No fix recorded)
commercial-grafana-12.4All versions (No fix recorded)
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.13All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.13All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.13All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyvernopre-1.13All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
configmap-reloadAll versions (No fix recorded)
configmap-reload-fipsAll versions (No fix recorded)
configmap-reload-fips-0.11All versions (No fix recorded)
configmap-reload-fips-0.12All versions (No fix recorded)
conftestAll versions (No fix recorded)
conjur-cliAll versions (No fix recorded)
consul-1.18All versions (No fix recorded)
consul-1.19All versions (No fix recorded)
consul-fips-1.20All versions (No fix recorded)
consul-k8s-1.4All versions (No fix recorded)
consul-k8s-1.5All versions (No fix recorded)
consul-k8s-fips-1.5All versions (No fix recorded)
containerd-2.1< 2.1.9-r11
containerd-fipsAll versions (No fix recorded)
containerd-shim-runc-v2-2.1< 2.1.9-r11
containerd-stress-2.1< 2.1.9-r11
continuityAll versions (No fix recorded)
controller-genAll versions (No fix recorded)
coredns-1.13All versions (No fix recorded)
coredns-1.14All versions (No fix recorded)
coredns-fips-1.13All versions (No fix recorded)
cri-toolsAll versions (No fix recorded)
crossplane-function-auto-readyAll versions (No fix recorded)
crossplane-function-environment-configs-fipsAll versions (No fix recorded)
crossplane-function-go-templatingAll versions (No fix recorded)
crossplane-function-go-templating-fipsAll versions (No fix recorded)
crossplane-function-patch-and-transform-fipsAll versions (No fix recorded)
crossplane-provider-aws-elasticacheAll versions (No fix recorded)
crossplane-provider-aws-route53recoverycontrolconfigAll versions (No fix recorded)
crossplane-provider-aws-route53recoverycontrolconfig-fipsAll versions (No fix recorded)
ctopAll versions (No fix recorded)
ctr-2.1< 2.1.9-r11
datadog-agent-7.75All versions (No fix recorded)
datadog-agent-7.76All versions (No fix recorded)
datadog-agent-7.77All versions (No fix recorded)
datadog-agent-fips-7.75All versions (No fix recorded)
datadog-agent-fips-7.77All versions (No fix recorded)
delveAll versions (No fix recorded)
dex-k8s-authenticatorAll versions (No fix recorded)
direnvAll versions (No fix recorded)
docker-credential-ecr-loginAll versions (No fix recorded)
docker-credential-ecr-login-fipsAll versions (No fix recorded)
docker-credential-gcrAll versions (No fix recorded)
docker-credential-gcr-fipsAll versions (No fix recorded)
docker-fips-28All versions (No fix recorded)
dockerizeAll versions (No fix recorded)
eks-distro-1.30All versions (No fix recorded)
eks-distro-fips-1.30All versions (No fix recorded)
elastic-agent-9.1All versions (No fix recorded)
elastic-agent-fips-9.1All versions (No fix recorded)
elvishAll versions (No fix recorded)
envoy-ai-gatewayAll versions (No fix recorded)
envoy-gateway-1.8-ratelimit-fe26676dAll versions (No fix recorded)
envoy-gateway-fips-1.8-ratelimit-fe26676dAll versions (No fix recorded)
envoy-ratelimit-fipsAll versions (No fix recorded)
esbuildAll versions (No fix recorded)
esbuild-fipsAll versions (No fix recorded)
etcd-3.4< 3.4.45-r0
etcd-3.6All versions (No fix recorded)
etcd-fips-3.4< 3.4.45-r0
etcd-fips-3.6All versions (No fix recorded)
external-secrets-operator-1.3All versions (No fix recorded)
external-secrets-operator-2.0All versions (No fix recorded)
external-secrets-operator-2.1All versions (No fix recorded)
external-secrets-operator-fips-1.2All versions (No fix recorded)
external-secrets-operator-fips-1.3All versions (No fix recorded)
external-secrets-operator-fips-2.0All versions (No fix recorded)
external-secrets-operator-fips-2.1All versions (No fix recorded)
falco-no-driverAll versions (No fix recorded)
filebrowserAll versions (No fix recorded)
flannel-cni-pluginAll versions (No fix recorded)
flannel-cni-plugin-fipsAll versions (No fix recorded)
fleet-server-9.1All versions (No fix recorded)
fleet-server-fips-9.1All versions (No fix recorded)
fzfAll versions (No fix recorded)
gatekeeper-3.20All versions (No fix recorded)
generic-device-pluginAll versions (No fix recorded)
generic-device-plugin-fipsAll versions (No fix recorded)
git-syncAll versions (No fix recorded)
git-sync-fipsAll versions (No fix recorded)
gitaly-init-cgroups-18.10All versions (No fix recorded)
gitaly-init-cgroups-18.11All versions (No fix recorded)
gitaly-init-cgroups-19.0All versions (No fix recorded)
gitaly-init-cgroups-19.1All versions (No fix recorded)
gitaly-init-cgroups-19.2All versions (No fix recorded)
gitaly-init-cgroups-19.3All versions (No fix recorded)
gitaly-init-cgroups-19.4All versions (No fix recorded)
gitaly-init-cgroups-19.5All versions (No fix recorded)
gitaly-init-cgroups-fips-18.10All versions (No fix recorded)
gitaly-init-cgroups-fips-18.11All versions (No fix recorded)
gitaly-init-cgroups-fips-19.0All versions (No fix recorded)
gitaly-init-cgroups-fips-19.1All versions (No fix recorded)
gitaly-init-cgroups-fips-19.2All versions (No fix recorded)
gitaly-init-cgroups-fips-19.3All versions (No fix recorded)
gitaly-init-cgroups-fips-19.4All versions (No fix recorded)
gitaly-init-cgroups-fips-19.5All versions (No fix recorded)
github-mcp-serverAll versions (No fix recorded)
gitlab-cng-18.10All versions (No fix recorded) | < 18.10.7-r1

Show all 200

1 vendor · 200 products · Showing 200 of 760

References

8 links

go.dev/issue/78916REPORT
go.dev/cl/770080REPORTFIX
groups.google.com/g/golang-announce/c/6MMI8Lj-AtgREPORTWEB
pkg.go.dev/vuln/GO-2026-5024REPORT
ubuntu.com/security/CVE-2026-39824REPORT
www.cve.org/CVERecord?id=CVE-2026-39824REPORT
github.com/golang/go/issues/78916REPORT
www.suse.com/security/cve/CVE-2026-39824WEB