CVE-2026-39824

Name	CVE-2026-39824
Description	NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-golang-x-sys (PTS)	bullseye	0.0~git20210124.22da62e-1	fixed
	bookworm	0.3.0-1	fixed
	trixie	0.22.0-1	fixed
	forky, sid	0.42.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-golang-x-sys	source	(unstable)	(not affected)

Notes

- golang-golang-x-sys <not-affected> (Only affects golang.org/x/sys on Windows)
https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg
https://github.com/golang/go/issues/78916