What is the CVSS score of CVE-2026-64951?

CVE-2026-64951 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 28.0%.

Is there a patch available for CVE-2026-64951?

Yes, a patch is available for CVE-2026-64951. Update the affected software to the latest version immediately.

Velociraptor CVE-2026-64951

EUVD-2026-57160 LOW

Divide By Zero (CWE-369)

2026-08-12 cve@rapid7.com

GHSA-frg5-mq2m-h39j

Denial Of Service

3.5

CVSS 3.1 · Vendor: rapid7

Severity by source

Vendor (rapid7) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.5 LOW

PR:L reflects mandatory enrolled-client authentication; UI:R for required GUI operator action; A:L for recoverable server crash with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (rapid7).

CVSS VectorVendor: rapid7

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Aug 12, 2026 - 11:16 EUVD

Analysis Generated

Aug 12, 2026 - 10:31 vuln.today

DescriptionCVE.org

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.

The problem is a Divide by Zero bug in the ShouldPadFile() function.

AnalysisAI

Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Two concrete conditions must both be satisfied. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.5 Low score is well-calibrated here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the Rapid7 Velociraptor security advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/ for the patched release version and upgrade instructions - exact fix version numbers are not confirmed from the available input data. … Detailed patch versions, workarounds, and compensating controls in full report.