Google Go standard library up to 1.26.8/1.27.1 os/internal/syscall/windows Root.Mkdir/Root.MkdirAll mount point

Summaryinfo

A vulnerability, which was classified as critical, was found in Google Go standard library up to 1.26.8/1.27.1. Affected by this vulnerability is the function Root.Mkdir/Root.MkdirAll of the component os/internal/syscall/windows. Executing a manipulation can lead to mount point. This vulnerability is registered as CVE-2026-56857. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Go standard library up to 1.26.8/1.27.1. It has been declared as critical. This vulnerability affects the function Root.Mkdir/Root.MkdirAll of the component os/internal/syscall/windows. The manipulation with an unknown input leads to a mount point vulnerability. The CWE definition for the vulnerability is CWE-1386. The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

This vulnerability was named CVE-2026-56857 since 06/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/09/2026).

Upgrading to version 1.26.9 or 1.27.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-95420). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go standard library

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.27.0
• 1.27.1

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion