What’s Vulnerable › Vulnerabilities
CVE-2026-7572: Velociraptor EVTX Parser — Process Crash via Crafted .evtx File
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-06 · updated 2026-07-24
- Weakness: CWE-193
Description
An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parse_evtx VQL plugin.
Affected products
- Rapid7 Velociraptor: before 0.76.5 — fixed in 0.76.5
How to fix
Upgrade to a fixed version: Rapid7 Velociraptor 0.76.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-7572 or the next vulnerability affects your stack