EUVD-2026-85881
GHSA-4f8c-84gc-p8pv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Local malformed-file parsing needs the tool to process attacker data (AV:L, UI:R, PR:N); crash-only out-of-bounds read is an availability impact (A:L) with no C/I and no scope change.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
AnalysisAI
Parsing a malformed Windows prefetch file through Velociraptor's bundled prefetch library (Velocidex/go-prefetch) can trigger an out-of-bounds condition and crash the parsing operation, an availability-only impact with no data disclosure or code execution. The issue is local and interaction-dependent: exploitation requires that an attacker-supplied or corrupted .pf artifact reach a location the parser processes and that a user or agent run the parse, consistent with the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L (the vendor-facing score of 3.6 rates it slightly higher with scope change and low integrity impact). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Velociraptor (or an application using the Velocidex go-prefetch library) to parse an attacker-supplied or malformed Windows prefetch file; the vulnerable decompression path is Windows-specific (the fix adds a //go:build windows tag and guards zero-length input/output_size in lzxpress_windows.go). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue and the signals broadly agree. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - the corrective change is commit 4bae9796298011598d577b125e0b3db3ee03eb74 in Velocidex/go-prefetch, which adds the //go:build windows constraint and an early return when len(input) == 0 || output_size == 0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today