Calamine versions before 0.38.0 contain a vulnerability in the Compound File Binary (OLE2) parser that can cause a panic or unbounded memory allocation when processing crafted spreadsheet files. This can lead to denial of service by crashing the application or exhausting system memory. The issue affects reading .xls, .xlsb, and extracting VBA projects from .xlsx files. The flaw is fixed in version 0.38.0.