CVE-2026-39824: NTUnicodeString Buffer Overflow Flaw

CVE-2026-39824 Overview

CVE-2026-39824 is an integer overflow vulnerability in the Go standard library's NewNTUnicodeString function. The function constructs a Windows NTUnicodeString structure, which uses a 16-bit field to express the byte length of the contained string. When callers pass a string whose byte length exceeds the maximum value representable in 16 bits, the function silently truncates the length rather than returning an error. The flaw is tracked as GO-2026-5024 and is classified under [CWE-190] Integer Overflow or Wraparound.

Critical Impact
A local attacker supplying an oversized string to a Go program using NewNTUnicodeString can cause silent truncation of the resulting NTUnicodeString, leading to integrity issues in downstream Windows API calls.

Affected Products

Go standard library — Windows-specific NewNTUnicodeString helper
Go applications on Windows that pass externally influenced strings into NTUnicodeString constructors
Versions prior to the fix referenced in the Go.dev Change Log Entry

Discovery Timeline

2026-05-22 - CVE-2026-39824 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-39824

Vulnerability Analysis

The NewNTUnicodeString function builds a Windows NTUnicodeString structure that the Windows kernel and Native API consume. The structure stores the string byte length in a 16-bit field, capping the addressable size at 65,535 bytes. The function does not validate that the input string fits inside that field. When the input exceeds the limit, the length value wraps and the structure references a truncated string while reporting a smaller size than the underlying buffer. Callers that rely on the returned structure receive data that no longer matches the original input, but no error is raised.

The issue is described in detail in the Go.dev Issue Tracker Entry and the Golang Announce Group Post.

Root Cause

The root cause is a missing bounds check before assigning the input length to the 16-bit Length and MaximumLength fields of the NTUnicodeString structure. The constructor converts a Go string to UTF-16 and assigns its byte length without verifying that the value fits in a uint16. The narrowing conversion truncates the high bits, producing a length that no longer reflects the actual data. This is a classic [CWE-190] integer overflow pattern in a type-conversion path.

Attack Vector

Exploitation requires local access and low privileges. An attacker who can influence a string passed into NewNTUnicodeString — for example, through command-line arguments, environment variables, file contents, or local IPC — can craft input that exceeds 65,535 bytes. The resulting truncation can cause downstream Windows system calls to operate on partial data, producing integrity violations such as path confusion, incorrect identifier matching, or skipped validation logic. The vulnerability does not provide direct code execution or information disclosure, and confidentiality and availability are not affected.

No verified public exploit code is available. Refer to the Go.dev Vulnerability Advisory for upstream technical details.

Detection Methods for CVE-2026-39824

Indicators of Compromise

No file-based or network IOCs are associated with this vulnerability.
Anomalous Go process behavior on Windows when handling very large string inputs, such as unexpected failures in Native API calls or mismatched path operations.

Detection Strategies

Inventory Windows-targeted Go binaries and identify those built against vulnerable Go versions listed in GO-2026-5024.
Run govulncheck against source trees and built binaries to flag direct or transitive use of NewNTUnicodeString from vulnerable Go releases.
Audit code paths that pass attacker-influenced strings into Windows Native API wrappers and confirm input length validation precedes the call.

Monitoring Recommendations

Log oversized string inputs (greater than 32 KB) handed to Windows path or object APIs in Go services.
Monitor for Native API call failures and STATUS_INVALID_PARAMETER returns originating from Go processes.
Track Go toolchain versions across build pipelines and alert when builds use Go releases below the patched version.

How to Mitigate CVE-2026-39824

Immediate Actions Required

Upgrade the Go toolchain to the patched release referenced in the Golang Announce Group Post and rebuild all Windows binaries.
Run govulncheck ./... across repositories to identify reachable call sites of NewNTUnicodeString in vulnerable versions.
Validate input length in application code before passing strings into Windows Native API helpers, rejecting inputs above 32,767 UTF-16 code units.

Patch Information

The upstream fix is published in the Go.dev Change Log Entry and tracked under advisory GO-2026-5024. The fix adds an explicit length check in NewNTUnicodeString and returns an error when the input cannot fit in the 16-bit length field. Rebuilding affected binaries with the updated Go release is required, since the Go runtime and standard library are statically linked.

Workarounds

Add a guard in calling code that rejects strings longer than 32,767 UTF-16 code units before invoking NewNTUnicodeString.
Restrict untrusted input from reaching code paths that build NTUnicodeString values, for example by validating file paths and identifiers at the application boundary.
Limit local access on hosts running affected Go services until binaries are rebuilt against the patched Go release.

bash

# Verify the installed Go version and scan for vulnerable usage
go version
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...