Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77797: Velociraptor may crash when reading bad prefetch files

CVE-2026-77797 · published 25 days ago

Summary

The Velociraptor tool can stop working if it tries to read a specially crafted prefetch file that is malformed. This could interrupt monitoring or forensic activities that rely on the tool. Update to the latest version or apply the provided patch to prevent the crash.

What to do

Update rapid7 velociraptor to version 0.77.3 or later.

Affected software

Vendor	Product	Affected versions
rapid7	velociraptor	< 0.77.3

Original advisory text

Velociraptor Prefetch parser out of bounds

Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-7797/ Vendor Advisory
https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3... Patch
https://github.com/Velocidex/velociraptor/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77797... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-77797 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.6 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

CWE-125Out-of-bounds Read

Timeline

Published24 Sep 2026

Updated10 Oct 2026

First seen24 Sep 2026

Sources

CVE-2026-77797 · NVD

CVE-2026-77797 · MITRE

CVE-2026-77797 · OSV

Track software like this

Free during beta