An off‑by‑one error in the ConsumeUnit16Array and ConsumeUnit64Array functions causes the parse_evtx VQL plugin to crash when processing a specially crafted .evtx file. The resulting crash leads to a denial of service, compromising the availability of Velociraptor services that run the plugin but does not affect confidentiality or integrity. The flaw is identified as CWE‑193. No code execution or privilege escalation is possible from this vulnerability.

Velocidex Velociraptor on both Windows and Linux platforms is affected for all releases prior to version 0.76.5. Users of these earlier releases are vulnerable unless the vendor issue has been remediated through a newer build.

The CVSS score of 4.4 reflects a moderate severity. The EPSS score is not provided, and the vulnerability is not listed in CISA KEV, indicating limited evidence of active exploitation in the wild. Based on the description, the likely attack vector is local: an adversary who can supply a custom .evtx file to the parse_evtx plugin can trigger the crash. Because the plugin runs with the privileges of the Velociraptor process, the impact is confined to the availability of that process, not to broader system compromise.