# CVE-2026-39824: Go x/sys/windows integer overflow in NewNTUnicodeString

Source: https://junglewise.ai/threats/cve-2026-39824-go-x-sys-windows-integer-overflow-in-newntunicodestring  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-39824 · Severity: info · Published 2026-05-22

A vulnerability exists in the Go programming language's Windows system library. The library fails to properly check the length of certain text strings, which can lead to data being cut off unexpectedly. This could potentially cause applications to process incomplete information or behave unpredictably when handling very large inputs.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Go Project](https://junglewise.ai/threats/vendors/go-project).

## Quick answers

**Is CVE-2026-39824 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39824 being exploited in the wild.

**How severe is CVE-2026-39824?** Informational severity, published 22 May 2026.

**Which products and versions are affected?** golang.org/x/sys (Go) SEMVER:introduced=0,fixed=0.44.0; Go Project X/Sys/Windows before v0.44.0.

**Is there a fix for CVE-2026-39824?** Yes. golang.org/x/sys (Go): upgrade to 0.44.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39824 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-39824?** Check whether you run golang.org/x/sys (Go) or Go Project X/Sys/Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/sys (Go): upgrade to 0.44.0 or later

  ```sh
  go get golang.org/x/sys@v0.44.0
  ```


## Technical details

An integer overflow vulnerability exists in the NewNTUnicodeString function within the golang.org/x/sys/windows and internal/syscall/windows packages. The function fails to validate if a provided string exceeds the maximum size of an NTUnicodeString (a 16-bit unsigned integer representing the byte length). When an oversized string is provided, the function returns a truncated string instead of an error. This can lead to memory safety issues or logic errors in Windows system calls that rely on precise string lengths. The issue is fixed in golang.org/x/sys v0.44.0.

## Affected products

- Go Project x/sys/windows before v0.44.0

## Identifiers

- CVE-2026-39824
- GO-2026-5024

## Timeline

- 2026-04-23: disclosed: Issue opened on Go GitHub repository
- 2026-05-22: advisory: CVE published and Go vulnerability report issued

## References

- [https://go.dev/cl/770080](https://go.dev/cl/770080)
- [https://go.dev/issue/78916](https://go.dev/issue/78916)
- [https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg](https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg)
- [https://pkg.go.dev/vuln/GO-2026-5024](https://pkg.go.dev/vuln/GO-2026-5024)

## Related threats

- [GO-2022-0493 - Incorrect privilege reporting in syscall and golang.org/x/sys/unix](https://junglewise.ai/threats/cve-2022-29526-golang-org-x-sys-unix-has-incorrect-privilege-reporting-in)