The vulnerability in Google go-attestation's Windows SIPA event log parser arises from uncontrolled recursion in the readELAMAggregation function. This function recurses for each nested elamAggregation sub-event but does not enforce a maximum recursion depth, allowing an attacker to bypass size guards on recursive paths. By submitting a specially crafted Windows event log with deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, causing a fatal runtime stack overflow error that crashes the verifier application. This leads to a denial of service condition.

An attacker can cause a denial of service by crashing the verifier application through stack overflow triggered by deeply nested crafted Windows event logs. There is no indication of privilege escalation, information disclosure, or code execution beyond the DoS impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time.