diff --git a/Lib/test/test_subprocess.py b/Lib/test/test_subprocess.py
index 875622302..bf0099554 100644
--- a/Lib/test/test_subprocess.py
+++ b/Lib/test/test_subprocess.py
@@ -857,7 +857,6 @@ class ProcessTestCase(BaseTestCase):
             self.assertEqual(p.returncode, 0)
             self.assertEqual(stdout.strip(), b"fruit=orange")
 
-    @unittest.expectedFailureIfWindows("TODO: RUSTPYTHON, null byte is not checked")
     def test_invalid_cmd(self):
         # null character in the command name
         cmd = sys.executable + '\0'
diff --git a/crates/vm/src/stdlib/winapi.rs b/crates/vm/src/stdlib/winapi.rs
index 3fb1068a6..1df3ff0e4 100644
--- a/crates/vm/src/stdlib/winapi.rs
+++ b/crates/vm/src/stdlib/winapi.rs
@@ -248,6 +248,18 @@ mod _winapi {
             Ok(ws.into_vec_with_nul())
         };
 
+        // Validate no embedded null bytes in command name and command line
+        if let Some(ref name) = args.name
+            && name.as_str().contains('\0')
+        {
+            return Err(crate::exceptions::cstring_error(vm));
+        }
+        if let Some(ref cmd) = args.command_line
+            && cmd.as_str().contains('\0')
+        {
+            return Err(crate::exceptions::cstring_error(vm));
+        }
+
         let app_name = args.name.map(wstr).transpose()?;
         let app_name = app_name.as_ref().map_or_else(null, |w| w.as_ptr());