EUVD-2026-56153
GHSA-5h5v-cxvm-wgr3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the specific dead-disk forensics deployment requirement; C:L acknowledges OOB read disclosure potential; I:N because no integrity impact is described; A:H for confirmed crash.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
6DescriptionCVE.org
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images.
Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g. dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.
If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.
AnalysisAI
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when processing maliciously crafted NTFS images. Specifically affects deployments using the dead disk forensics workflow where Velociraptor ingests untrusted NTFS image files rather than live filesystems. An attacker who can supply a corrupted NTFS volume to a Velociraptor analyst can crash the tool, disrupting forensic investigations. No public exploit identified at time of analysis; patch available in version 0.77.2 and later.
Technical ContextAI
Velociraptor (CPE: cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) is a Rapid7 open-source DFIR platform used for endpoint visibility, hunting, and forensic collection. Its NTFS parser processes raw filesystem structures to extract artifacts from both live endpoints and offline disk images. The root cause is CWE-125 (Out-of-bounds Read): the parser fails to validate bounds when traversing NTFS data structures, and also does not enforce limits on memory allocation, enabling memory exhaustion. Tags indicate a buffer overflow component alongside the OOB read, suggesting the parser improperly handles malformed record sizes or attribute lengths. The dead disk forensics workflow (documented at docs.velociraptor.app) explicitly mounts and parses untrusted NTFS image files, creating the attack surface that live-filesystem use avoids.
RemediationAI
Upgrade Velociraptor to version 0.77.2 or later, which contains the vendor-released patch addressing the out-of-bounds and memory exhaustion bugs in the NTFS parser. The fix is documented at http://docs.velociraptor.app/announcements/advisories/cve-2026-18635/. As a compensating control for environments that cannot upgrade immediately, avoid using Velociraptor's dead disk forensics workflow (https://docs.velociraptor.app/docs/forensic/deaddisk/) against NTFS images sourced from untrusted or adversary-controlled systems; restrict dead-disk analysis to images obtained from known-safe sources. Note that this workaround limits forensic capability and is not a substitute for patching. Live NTFS filesystem analysis on running endpoints is not considered an equivalent risk vector per the vendor description.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today