Executive brief
Velociraptor is an open-source endpoint monitoring and digital forensics tool used by security teams to investigate systems. A vulnerability in its event log parsing component allows a local attacker to crash the Velociraptor client by providing a specially crafted Windows event log (.evtx) file. This results in a denial of service, preventing security teams from monitoring or investigating the affected system until the service is restored.
Technical details
An off-by-one error (CWE-193) exists within the ConsumeUnit16Array and ConsumeUnit64Array functions of the Velocidex Velociraptor EVTX parser. The vulnerability is triggered when the parse_evtx VQL plugin processes a maliciously crafted .evtx file, leading to a memory corruption that causes the process to crash. While the attack vector is local, it requires user interaction (UI:R) in the form of a user or automated artifact tasking the client to parse the malicious file. The issue affects Velociraptor on both Windows and Linux platforms. A fix is available in version 0.76.5; as a workaround, users can collect raw EVTX files for offline parsing rather than using live VQL parsing artifacts.
Affected products
- Velocidex Velociraptor before 0.76.5
Timeline
- 2026-05-04: advisory: Vendor advisory published by Rapid7/Velociraptor
- 2026-05-06: disclosed: CVE published to NVD