CVE-2026-7572: Velociraptor EVTX Parser — Process Crash via Crafted .evtx File
An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parseevtx VQL plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Velocidex Velociraptorto a version that resolves this vulnerability.Fixed in 0.76.5 - Compensating control
Restrict access to the Velociraptor parse_evtx VQL plugin so only trusted users can submit EVTX files, and avoid parsing untrusted/crafted .evtx files to prevent process crashes (DoS).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7572?
CVE-2026-7572 has a moderate severity due to its potential to cause a Denial of Service (DoS) via process crashes.
How do I fix CVE-2026-7572?
To fix CVE-2026-7572, update Velocidex Velociraptor to version 0.76.5 or later.
What types of systems are affected by CVE-2026-7572?
CVE-2026-7572 affects Velocidex Velociraptor running on both Windows and Linux systems.
What kind of attack does CVE-2026-7572 enable?
CVE-2026-7572 enables a local attacker to launch a Denial of Service (DoS) attack via a crafted .evtx file.
Which functions are responsible for the CVE-2026-7572 vulnerability?
The vulnerability in CVE-2026-7572 arises from an off-by-one error in the ConsumeUnit16Array and ConsumeUnit64Array functions.