# CVE-2026-7572: Velocidex Velociraptor denial of service in EVTX parser

Source: https://junglewise.ai/threats/cve-2026-7572-velocidex-velociraptor-denial-of-service-in-evtx-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-7572 · Severity: medium · CVSS 4.4 · Published 2026-05-06

Velociraptor is an open-source endpoint monitoring and digital forensics tool used by security teams to investigate systems. A vulnerability in its event log parsing component allows a local attacker to crash the Velociraptor client by providing a specially crafted Windows event log (.evtx) file. This results in a denial of service, preventing security teams from monitoring or investigating the affected system until the service is restored.

Technologies: [www.velocidex.com/golang/velociraptor (Go)](https://junglewise.ai/threats/technologies/www-velocidex-com-golang-velociraptor), [Velocidex Velociraptor](https://junglewise.ai/threats/technologies/velociraptor). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Velocidex](https://junglewise.ai/threats/vendors/velocidex).

## Quick answers

**Is CVE-2026-7572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7572 being exploited in the wild.

**How severe is CVE-2026-7572?** Medium severity, with a CVSS score of 4.4, published 6 May 2026.

**Which products and versions are affected?** www.velocidex.com/golang/velociraptor (Go) < 0.76.5, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.76.5; Velocidex Velociraptor < 0.76.5.

**Is there a fix for CVE-2026-7572?** Yes. www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7572 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-7572?** Check whether you run www.velocidex.com/golang/velociraptor (Go) or Velocidex Velociraptor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- www.velocidex.com/golang/velociraptor (Go): upgrade to 0.76.5 or later

  ```sh
  go get www.velocidex.com/golang/velociraptor@v0.76.5
  ```


## Technical details

An off-by-one error (CWE-193) exists within the ConsumeUnit16Array and ConsumeUnit64Array functions of the Velocidex Velociraptor EVTX parser. The vulnerability is triggered when the parse_evtx VQL plugin processes a maliciously crafted .evtx file, leading to a memory corruption that causes the process to crash. While the attack vector is local, it requires user interaction (UI:R) in the form of a user or automated artifact tasking the client to parse the malicious file. The issue affects Velociraptor on both Windows and Linux platforms. A fix is available in version 0.76.5; as a workaround, users can collect raw EVTX files for offline parsing rather than using live VQL parsing artifacts.

## Affected products

- Velocidex Velociraptor before 0.76.5

## Identifiers

- CVE-2026-7572
- GHSA-6cmp-qv2f-x97x
- GO-2026-5174

## Timeline

- 2026-05-04: advisory: Vendor advisory published by Rapid7/Velociraptor
- 2026-05-06: disclosed: CVE published to NVD

## References

- [https://docs.velociraptor.app/announcements/advisories/cve-2026-7572/](https://docs.velociraptor.app/announcements/advisories/cve-2026-7572/)

## Related threats

- [Velociraptor SQL plugin missing authorization checks](https://junglewise.ai/threats/cve-2026-85737-velociraptor-is-a-tool-for-collecting-host-based-state)
- [Velociraptor privilege escalation in Windows.Sysinternals.SysmonLogForward artifact](https://junglewise.ai/threats/cve-2026-78413-velociraptor-allows-collection-of-vql-queries-packaged-into)
- [Velociraptor deadlock condition in user management module](https://junglewise.ai/threats/cve-2026-77798-velociraptor-contains-a-deadlock-condition-that-may-be-triggered)
- [Velociraptor VQL injection in notebook backup restore](https://junglewise.ai/threats/cve-2026-19584-velociraptor-vql-injection-in-notebook-backup-restore)
- [Velociraptor permission bypass via client monitoring artifacts](https://junglewise.ai/threats/cve-2026-19583-velociraptor-permission-bypass-via-client-monitoring-artifacts)