CVE Catalog
CVE-2026-39824
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk0.11%
2th percentile - higher than 2% of all known CVEs
Summary
The NewNTUnicodeString function does not check for string length overflow. When given a string exceeding the maximum NTUnicodeString size (16-bit byte count), it returns a truncated string instead of an error.
Risk Assessment
The organization is at risk of errors in Unicode string processing, potentially leading to unexpected system behavior or data truncation attacks.
Recommendation
Update the component containing NewNTUnicodeString to a version that checks for length overflow.
Original NVD description (English source)
NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.