The evtx crate versions from 0.11.0 up to but not including 0.15.1 contain a vulnerability in the .wevtcache file parser where an unbounded memory allocation occurs. This happens because the code reads a 64-bit length field from the file and allocates a buffer of that size without verifying it fits within the actual file size, allowing a crafted file to cause a multi-gigabyte allocation and crash the process due to out-of-memory conditions. The issue is fixed in version 0.15.1.