AZL-87161 CVE-2026-39824 affecting package azl-otel-collector 0.127.0-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87215 CVE-2026-39824 affecting package cri-o 1.30.1-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-87299 CVE-2026-39824 affecting package podman 5.6.1-10

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

AZL-98697 CVE-2026-39824 affecting package golang 1.27.1-1

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...

CVE-2026-39824

In CVE-2026-39824, the issue is in golang.org/x/sys/windows: NewNTUnicodeString does not validate string length against the 16-bit NTUnicodeString size. This can cause an overflow and result in a truncated string instead of an error. Public references indicate the vulnerability affects Go-related...

GO-2026-5024 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString a 16-bit number of bytes, it returns a truncated string rather than an error...