EUVD-2026-56180
GHSA-46vh-7xwv-8rrp
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector confirmed: attacker must deliver a crafted NTFS image to the target system; no network path or authentication required to trigger the parser during forensic ingestion.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images.
Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g. dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.
If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.
AnalysisAI
Velociraptor's NTFS parsing library contains out-of-bounds read and memory exhaustion flaws that allow a crash and denial of service when processing maliciously crafted NTFS images. All versions of Rapid7's Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) are affected, with meaningful exposure limited to dead disk forensics workflows where untrusted NTFS images are ingested - live filesystem analysis is largely insulated from this attack path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that Velociraptor be actively processing an untrusted, attacker-controlled NTFS image file through the dead disk forensics workflow (as documented at https://docs.velociraptor.app/docs/forensic/deaddisk/). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 6.2 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a local, low-complexity denial-of-service condition with no confidentiality or integrity impact as described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence the NTFS disk image delivered to a forensic analyst - for example, by tampering with a cloned disk image before it enters the forensic workflow - provides a specially crafted NTFS volume with malformed metadata structures. When the analyst loads the image in Velociraptor for a dead disk forensics investigation, the NTFS parser triggers an out-of-bounds read or memory exhaustion condition, crashing the Velociraptor process and denying continued forensic analysis. … |
| Remediation | Consult the Rapid7 Velociraptor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-17535/ for the official patched version - no exact fix version was available in the provided intelligence data, so the advisory is the authoritative source for patch confirmation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Pro
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today