internal/syscall/windows vulnerabilities

Latest internal/syscall/windows CVEs

Newest publication first

1. CVE-2026-56857 Root.Mkdir(All) can follow junctions out of the root on Windows in os

   Published 2026-10-08

   Critical·CVSS 9.8

   On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.