This vulnerability involves inconsistent behavior in the Go standard library's syscall package's os.OpenFile function when opening files with the O_CREATE and O_EXCL flags set. Specifically, on Unix systems, OpenFile does not follow dangling symbolic links, preventing file creation at the symlink target. However, on Windows systems, OpenFile would follow a dangling symlink and create a file at the nonexistent target location, potentially leading to unintended file creation or manipulation. The fix ensures that OpenFile returns an error if both O_CREATE and O_EXCL are set and the target path is a symlink, aligning behavior across platforms and preventing this improper link resolution.

The vulnerability allows for unintended file creation on Windows systems when opening a file path that is a dangling symlink with O_CREATE and O_EXCL flags. This could lead to improper file manipulation or security bypass scenarios where an attacker might exploit the symlink behavior to influence file creation. The CVSS score of 5.5 indicates a medium severity with a local attack vector, low complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity impact and no availability impact.

No official patch links are provided in the data, and patch status is not explicitly confirmed. Therefore, patch status is not yet confirmed — check the Go project vendor advisory for current remediation guidance. Users should avoid relying on os.OpenFile with O_CREATE and O_EXCL flags on Windows for paths that may be symlinks until an official fix is confirmed.