Executive Risk Summary
"A memory leak vulnerability exists in the go-crypto-winnative Go package prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, which can cause a small memory leak every time calls to `cng.TLS1PRF` are made. The vulnerability is fixed in versions 1.23.6-2 and 1.22.12-2 of the Microsoft build of go, as well as in the pseudoversion 0.0.0-20250211154640-f49c8e1379ea of the `github.com/microsoft/go-crypto-winnative` Go package."
Operational Audit Arsenal
Target Type DLL
Target Asset go-crypto-winnative.dll
Standard Path %windir%\System32
PowerShell
# 🛠️ Senior Engineer Universal Audit
# Target: go-crypto-winnative.dll (DLL)
$Targets = 'go-crypto-winnative.dll'
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")
Get-ChildItem -Path $SearchPaths -Include $Targets -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}Patch Impact Forecast
Reboot Required Unlikely
Go-based services may be affected
Internal Work Notes
Apply updated go-crypto-winnative package to prevent memory leak vulnerability
Technical Intelligence & Operational Utilities • Delivered Weekly
Intelligence Sources
Related Microsoft Threats
Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.