CVE-2026-17535
Received Received - Intake

NTFS Parser Memory Exhaustion in Velociraptor

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Rapid7, Inc.

Description
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However, in some applications (e.g.  dead disk forensics https://docs.velociraptor.app/docs/forensic/deaddisk/ ) Velociraptor may be used on untrusted NTFS image files.  If an attacker is able to inject maliciously corrupted NTFS Volumes they can cause a crash and a Denial of Service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-17535
EUVD
EUVD-2026-56180

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
velociraptor velociraptor to 0.77.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-369 The product divides a value by zero.
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-17535 involves multiple crashes in Velociraptor's NTFS parser when processing invalid NTFS volumes. The vulnerability arises from out-of-bounds reads, memory exhaustion due to excessive allocation sizes, and divide-by-zero errors in the parser.

Detection Guidance

Detecting this vulnerability requires checking Velociraptor version and monitoring for crashes during NTFS parsing. Use 'velociraptor version' to verify if your version is below 0.77.2. Monitor system logs for NTFS parsing errors or crashes when processing disk images.

Impact Analysis

Attackers could exploit this by providing maliciously crafted NTFS images, leading to crashes and denial-of-service conditions. This issue is particularly relevant in scenarios like dead disk forensics where Velociraptor processes untrusted NTFS image files.

Compliance Impact

This vulnerability primarily causes Denial of Service (DoS) conditions by crashing the NTFS parser with maliciously crafted images. It does not directly impact confidentiality or integrity of data, which are key concerns for GDPR and HIPAA compliance. However, prolonged DoS conditions could disrupt forensic investigations or system availability, potentially affecting compliance with data retention or accessibility requirements.

Mitigation Strategies

Immediately update Velociraptor to version 0.77.2 or later. Avoid processing untrusted NTFS images until patched. Restrict access to Velociraptor's NTFS parsing functions in forensic workflows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17535. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart