CVE-2026-64951

LowCVSS 3.5

Published: 12/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A rogue Velociraptor client can upload a malformed sparse file that causes a panic when the GUI attempts to expand it, potentially crashing the server process. The issue is a Divide by Zero bug in the ShouldPadFile() function.

Risk Assessment

A remote attacker can crash the Velociraptor server, leading to service disruption.

Recommendation

Update Velociraptor to a patched version and restrict file upload capabilities for clients.

Original NVD description (English source)

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.