String Length Overflow Vulnerability in NewNTUnicodeString by Golang

CVE-2026-39824

What is CVE-2026-39824?

The NewNTUnicodeString implementation in Golang has a vulnerability that allows for string length overflow. This issue arises when an input string exceeds the storage capacity allocated for a NTUnicodeString, which is defined by a 16-bit number of bytes. Instead of generating an error to signal the overflow condition, the function incorrectly returns a truncated string. This behavior can lead to unintended consequences in software execution, potentially allowing for data corruption or security breaches.

References