The vulnerability is an unbounded memory allocation in the VQLResponse result‑set writer of Velociraptor’s server. A malicious or compromised client can send crafted messages on the normal agent control channel, causing the server to allocate excessive memory and trigger an out‑of‑memory condition that crashes the service. The resulting denial of service prevents the server from handling legitimate requests, impacting availability but not confidentiality or integrity.

Rapid7 Velociraptor servers running any 0.76 release earlier than version 0.76.4 and any 0.75 release earlier than version 0.75.9 are affected. The vulnerability exists only in the server component; client binaries are not directly impacted.

The CVSS score of 4.9 indicates moderate severity. Since EPSS is not available, no concrete exploitation probability is known. The CVE is not listed in CISA’s KEV catalog. Attackers would need network access to a Velociraptor client that has the ability to send messages to the server, so the vector is likely local or internal network. A successful exploit results in a server crash; the impact is limited to service outage.