The vulnerability exists in the golang.org/x/sys/windows package, where the NewNTUnicodeString function does not enforce the maximum length limit of a NTUnicodeString. When a string larger than the 16‑bit length field is supplied, the function silently truncates the string instead of reporting an error.

The only vendor and product explicitly listed is golang.org/x/sys/windows. No specific versions are given, so any release that uses the current implementation of NewNTUnicodeString before a fix may be impacted.

EPSS information is not available and the issue is not listed in CISA KEV, indicating limited publicly known exploitation. The problem is an integer overflow that leads to truncation, but no exploitation details are disclosed. The risk depends on how the function is used in applications; it may cause unexpected behavior if the full string is required.