Executive brief
A vulnerability exists in the Go programming language's Windows system library. The library fails to properly check the length of certain text strings, which can lead to data being cut off unexpectedly. This could potentially cause applications to process incomplete information or behave unpredictably when handling very large inputs.
Technical details
An integer overflow vulnerability exists in the NewNTUnicodeString function within the golang.org/x/sys/windows and internal/syscall/windows packages. The function fails to validate if a provided string exceeds the maximum size of an NTUnicodeString (a 16-bit unsigned integer representing the byte length). When an oversized string is provided, the function returns a truncated string instead of an error. This can lead to memory safety issues or logic errors in Windows system calls that rely on precise string lengths. The issue is fixed in golang.org/x/sys v0.44.0.
Affected products
- Go Project x/sys/windows before v0.44.0
Timeline
- 2026-04-23: disclosed: Issue opened on Go GitHub repository
- 2026-05-22: advisory: CVE published and Go vulnerability report issued