The vulnerability exists in the golang.org/x/sys/windows package, where the NewNTUnicodeString function does not enforce the maximum length limit of a NTUnicodeString. When a string larger than the 16‑bit length field is supplied, the function silently truncates the string instead of reporting an error.

The only vendor and product explicitly listed is golang.org/x/sys/windows. No specific versions are given, so any release that uses the current implementation of NewNTUnicodeString before a fix may be impacted.

The EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in CISA KEV, suggesting limited publicly known exploits. The problem is an integer overflow that leads to truncation, but no exploitation details are disclosed. The risk depends on how the function is used in applications; it may cause unexpected behavior if the full string is required. The CVSS score of 3.3 indicates low impact.