EUVD-2026-31498
Integer Overflow or Wraparound (CWE-190)
GHSA-4vpj-hr3r-4gpg
3.3
CVSS 3.1
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Lifecycle Timeline
4
Analysis Generated
May 27, 2026 - 22:15 vuln.today
CVSS changed
May 27, 2026 - 19:37 NVD
3.3 (LOW)
CVE Published
May 22, 2026 - 19:39 nvd
LOW 3.3
CVE Published
May 22, 2026 - 19:39 nvd
UNKNOWN (no severity yet)
DescriptionNVD
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.
AnalysisAI
Integer overflow in NewNTUnicodeString within the Go extended syscall package for Windows allows a local low-privileged attacker to silently inject a truncated NTUnicodeString into applications that expect validation failures on oversized input. Affected is golang.org/x/sys/windows before version 0.44.0. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).