PT-2026-37338 · Velocidex · Velociraptor

Javier Perez · Published 2026-05-06 · Updated 2026-06-01 · CVE-2026-7572

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Velocidex Velociraptor versions prior to 0.76.5

Description An off-by-one error in the ConsumeUnit16Array() and ConsumeUnit64Array() functions allows a local attacker to cause a Denial of Service (DoS) via a process crash. This occurs when a specially crafted .evtx file is provided to the 'parse evtx' VQL plugin. An off-by-one error is a situation where a program iterates one time too many or too few, often leading to memory access violations.

Recommendations Update to version 0.76.5 or later.

Fix

DoS

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2026-7572

GHSA-6CMP-QV2F-X97X

Affected Products

Velociraptor

References · 8

• https://osv.dev/vulnerability/GHSA-6cmp-qv2f-x97x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7572 · Security Note
• https://docs.velociraptor.app/announcements/advisories/cve-2026-7572 · Vendor Advisory
• https://github.com/Velocidex/velociraptor · Note
• https://twitter.com/VulmonFeeds/status/2051936185535111471 · Twitter Post
• https://t.me/cveNotify/162282 · Telegram Post
• https://t.me/cveNotify/165493 · Telegram Post
• https://t.me/CVEtracker/52812 · Telegram Post