Is CVE-2026-39824 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39824 being exploited in the wild.

How severe is CVE-2026-39824?

Informational severity, published 22 May 2026.

Which products and versions are affected?

golang.org/x/sys (Go) SEMVER:introduced=0,fixed=0.44.0; Go Project X/Sys/Windows before v0.44.0.

Is there a fix for CVE-2026-39824?

Yes. golang.org/x/sys (Go): upgrade to 0.44.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39824 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-39824?

Check whether you run golang.org/x/sys (Go) or Go Project X/Sys/Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39824: Go x/sys/windows integer overflow in NewNTUnicodeString

CVE-2026-39824 · Severity: info · Published 2026-05-22

A vulnerability exists in the Go programming language's Windows system library. The library fails to properly check the length of certain text strings, which can lead to data being cut off unexpectedly. This could potentially cause applications to process incomplete information or behave unpredictably when handling very large inputs.

Vendors: Go, Go Project.

Quick answers

Is CVE-2026-39824 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39824 being exploited in the wild.
How severe is CVE-2026-39824?: Informational severity, published 22 May 2026.
Which products and versions are affected?: golang.org/x/sys (Go) SEMVER:introduced=0,fixed=0.44.0; Go Project X/Sys/Windows before v0.44.0.
Is there a fix for CVE-2026-39824?: Yes. golang.org/x/sys (Go): upgrade to 0.44.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39824 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-39824?: Check whether you run golang.org/x/sys (Go) or Go Project X/Sys/Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/sys (Go): upgrade to 0.44.0 or later
```
go get golang.org/x/sys@v0.44.0
```

Technical details

An integer overflow vulnerability exists in the NewNTUnicodeString function within the golang.org/x/sys/windows and internal/syscall/windows packages. The function fails to validate if a provided string exceeds the maximum size of an NTUnicodeString (a 16-bit unsigned integer representing the byte length). When an oversized string is provided, the function returns a truncated string instead of an error. This can lead to memory safety issues or logic errors in Windows system calls that rely on precise string lengths. The issue is fixed in golang.org/x/sys v0.44.0.

Affected products

Go Project x/sys/windows before v0.44.0

Identifiers

CVE-2026-39824
GO-2026-5024

Timeline

2026-04-23: disclosed: Issue opened on Go GitHub repository
2026-05-22: advisory: CVE published and Go vulnerability report issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.