p PatchFirst

CVE-2026-39824

CVE-2026-39824 · Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS 3.3 · Low · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • golang.org/x/sys/windows

    Versions
    • ≥ 0, < 0.44.0: Affected (semver)

    Update to 0.44.0

  • golang-golang-x-sys Ubuntu:16.04:LTS

    Versions
    • 0.0~git20150612-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20201217.02-0ubuntu1~16.04.0
    • 20230426.00-0ubuntu2~16.04.3
    • 20231004.02-0ubuntu1~16.04.1
    • 20231004.02-0ubuntu1~16.04.2
    • 20240716.00-0ubuntu1~16.04.0
    • 20240716.00-0ubuntu1~16.04.0+esm1
    • 20240716.00-0ubuntu1~16.04.0+esm2
    • 20240716.00-0ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:18.04:LTS

    Versions
    • 0.0~git20170727.0.35ef448-1
    • 0.0~git20170727.0.35ef448-2
    • 0.0~git20180308.349b81f-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:18.04:LTS

    Versions
    • 20201217.02-0ubuntu1~18.04.0
    • 20210414.00-0ubuntu1~18.04.0
    • 20210629.00-0ubuntu1~18.04.1
    • 20220622.00-0ubuntu2~18.04.0
    • 20220622.00-0ubuntu2~18.04.1
    • 20230426.00-0ubuntu2~18.04.0
    • 20231004.02-0ubuntu1~18.04.2
    • 20231004.02-0ubuntu1~18.04.3
    • 20240716.00-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0+esm1
    • 20241011.01-0ubuntu1~18.04.0+esm2
    • 20241011.01-0ubuntu1~18.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:20.04:LTS

    Versions
    • 20201217.02-0ubuntu1~20.04.0
    • 20210414.00-0ubuntu1~20.04.0
    • 20210629.00-0ubuntu1~20.04.0
    • 20220622.00-0ubuntu2~20.04.0
    • 20220622.00-0ubuntu2~20.04.2
    • 20230426.00-0ubuntu2~20.04.0
    • 20231004.02-0ubuntu1~20.04.1
    • 20231004.02-0ubuntu1~20.04.2
    • 20231004.02-0ubuntu1~20.04.3
    • 20231004.02-0ubuntu1~20.04.4
    • 20240716.00-0ubuntu1~20.04.0
    • 20241011.01-0ubuntu1~20.04.1
    • 20250116.00-0ubuntu1~20.04.0
    • 20250116.00-0ubuntu1~20.04.0+esm1
    • 20250116.00-0ubuntu1~20.04.0+esm2
    • 20250116.00-0ubuntu1~20.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:20.04:LTS

    Versions
    • 0.0~git20190726.fc99dfb-1ubuntu1
    • 0.0~git20190726.fc99dfb-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:22.04:LTS

    Versions
    • 0.0~git20210124.22da62e-1
    • 0.0~git20210806.e5e7981-1
    • 0.0~git20211117.dee7805-1
    • 0.0~git20211216.1d35b9e-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:22.04:LTS

    Versions
    • 20210629.00-0ubuntu1
    • 20210629.00-0ubuntu2
    • 20220104.00-0ubuntu1
    • 20220104.00-0ubuntu2
    • 20220622.00-0ubuntu2~22.04.0
    • 20220622.00-0ubuntu2~22.04.1
    • 20230426.00-0ubuntu2~22.04.0
    • 20231004.02-0ubuntu1~22.04.1
    • 20231004.02-0ubuntu1~22.04.2
    • 20231004.02-0ubuntu1~22.04.3
    • 20231004.02-0ubuntu1~22.04.4
    • 20231004.02-0ubuntu1~22.04.5
    • 20240716.00-0ubuntu1~22.04.0
    • 20241011.01-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.1
    • 20250116.00-0ubuntu1~22.04.2
    • 20250116.00-0ubuntu1~22.04.3
    • 20250116.00-0ubuntu1~22.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:24.04:LTS

    Versions
    • 0.8.0-1
    • 0.13.0-1
    • 0.15.0-1
    • 0.16.0-1
    • 0.17.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:24.04:LTS

    Versions
    • 20230426.00-0ubuntu3
    • 20231004.02-0ubuntu1
    • 20231004.02-0ubuntu3
    • 20240213.00-0ubuntu1
    • 20240213.00-0ubuntu2
    • 20240213.00-0ubuntu3
    • 20240213.00-0ubuntu3.1
    • 20240213.00-0ubuntu3.2
    • 20240716.00-0ubuntu1~24.04.0
    • 20240716.00-0ubuntu1~24.04.1
    • 20241011.01-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.1
    • 20250116.00-0ubuntu1~24.04.2
    • 20250116.00-0ubuntu1~24.04.3
    • 20250116.00-0ubuntu1~24.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:25.10

    Versions
    • 0.22.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:25.10

    Versions
    • 20250116.00-0ubuntu2
    • 20250506.01-0ubuntu1
    • 20250506.01-0ubuntu1.1
    • 20250506.01-0ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:26.10

    Versions
    • 0.38.0-1
    • 0.45.0+dfsg-1
    • 0.47.0+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.10

    Versions
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu3
    • 20260819.00+~20260819.00-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-golang-x-sys Ubuntu:26.04:LTS

    Versions
    • 0.22.0-1
    • 0.38.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.04:LTS

    Versions
    • 20250506.01-0ubuntu1
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →