Looks good from my end. This is probably worthy of a change log entry.

Slightly corrected previous commit:

1. CryptUnprotectData accepts null as pointer to description. We don't use it here, so I got rid of it.
2. Clear result byte array when LocalFree fails and hence CryptProtectData/CryptUnprotectData throws exception

Also looks good to me. I agree with @dbwiddis though, this warrants an entry in the CHANGES.md file in the Bug Fixes section. For the synopsis I think something like:

Clear security sensitive data after usage in c.s.j.p.win32.Crypt32Util#cryptUnprotectData and #cryptUnprotectData.

As a rule of thumb: Changes that affect users should have an entry in the CHANGES.md- it basicly answers the question: "Why should I bother to update?".

Ok. I will change the commit message and also will try to write unit test for the issue (based on the program that demonstrates the problem).
And, just make it precise, may/should I add an entry in the CHANGES.md as well?

Yes, the suggested blurb above should be in CHANGES.md in the Bug Fixes section, following the same format as the other entries.

Looks good to me. Thank you.