EUVD-2026-57160
GHSA-frg5-mq2m-h39j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
PR:L reflects mandatory enrolled-client authentication; UI:R for required GUI operator action; A:L for recoverable server crash with no confidentiality or integrity impact.
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
2DescriptionCVE.org
A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.
The problem is a Divide by Zero bug in the ShouldPadFile() function.
AnalysisAI
Divide-by-zero in Velociraptor's ShouldPadFile() function allows a rogue enrolled client to crash the server process by uploading a malformed sparse file. When a GUI operator attempts to expand the file in the web interface, the unguarded division triggers a Go runtime panic, taking down the server. No public exploit code is identified at time of analysis, and CVSS rates this Low (3.5) with availability-only impact, but the attack is straightforward for any attacker who controls an enrolled endpoint.
Technical ContextAI
Velociraptor is an open-source Digital Forensics and Incident Response (DFIR) endpoint monitoring and collection platform developed by Rapid7, used primarily in security operations and incident response environments. The vulnerability is rooted in CWE-369 (Divide by Zero) within the ShouldPadFile() function, which is responsible for evaluating sparse file layouts uploaded by connected clients. A sparse file can embed metadata that supplies a zero-valued divisor; because no validation guards against this, the arithmetic operation faults and the Go runtime issues a panic, which terminates the server process. The trigger path requires both client upload and subsequent GUI-side expansion, making this a two-stage server-side crash rather than a purely passive parsing bug.
RemediationAI
Consult the Rapid7 Velociraptor security advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/ for the patched release version and upgrade instructions - exact fix version numbers are not confirmed from the available input data. As a compensating control prior to patching, restrict client enrollment so that only fully trusted, managed endpoints can connect to the Velociraptor server, reducing the attacker's ability to supply malformed uploads. Additionally, limit GUI access to sparse file expansion workflows to a minimal set of trusted operators, reducing the UI:R trigger surface. Note that restricting GUI access does not eliminate the vulnerability but delays triggering it until an authorized operator encounters the file.
Same weakness CWE-369 – Divide By Zero
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today