CVE-2026-64951: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-64951 is a Divide by Zero vulnerability in Rapid7's Velociraptor endpoint monitoring platform that allows a rogue client to crash the server process by uploading a malformed sparse file. The flaw resides in the ShouldPadFile() function and is triggered when the GUI attempts to expand the malicious file. All Velociraptor versions prior to 0.77.2 are affected. It carries a CVSS v3.1 base score of 3.5 (Low), published on August 12, 2026 (GitHub Advisory).

The root cause is a Divide by Zero bug (CWE-369) in the ShouldPadFile() function within Velociraptor's sparse file handling logic. A rogue client — one with low-privilege network access — can craft and upload a malformed sparse file that contains a zero-valued divisor. When a GUI user subsequently attempts to expand the file, the server process encounters the divide-by-zero condition, triggers a Go runtime panic, and crashes. Exploitation requires both an authenticated (low-privilege) attacker to upload the file and a separate user interaction (GUI expansion) to trigger the panic (GitHub Advisory).

Successful exploitation results in a denial of service (DoS) by crashing the Velociraptor server process. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In environments where Velociraptor is used for active incident response or endpoint monitoring, a server crash could disrupt forensic investigations and blind defenders to ongoing threats (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.281%, placing it in the 20th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not fully automated — it requires both a low-privilege attacker to upload the malformed file and a separate GUI user interaction to trigger the crash (GitHub Advisory).

1. Gain low-privilege access: Obtain or compromise a Velociraptor client with valid credentials sufficient to upload files to the server.
2. Craft malformed sparse file: Construct a sparse file with a zero-valued chunk size or offset that will cause a division by zero when processed by the ShouldPadFile() function.
3. Upload the malformed file: Use the rogue Velociraptor client to upload the crafted sparse file to the Velociraptor server.
4. Wait for GUI interaction: Wait for (or socially engineer) a GUI user to navigate to the uploaded file and attempt to expand it in the Velociraptor web interface.
5. Server crash triggered: The ShouldPadFile() function performs a divide-by-zero operation, causing a Go runtime panic that crashes the Velociraptor server process (GitHub Advisory).

• Logs: Velociraptor server logs showing a Go runtime panic with a stack trace referencing the ShouldPadFile() function; unexpected server process termination events in system logs.
• File System: Presence of unusually structured or zero-length-chunk sparse files in the Velociraptor file upload directory or artifact storage.
• Process: Sudden termination of the Velociraptor server process (velociraptor binary) without a graceful shutdown signal; automatic restart events if a process supervisor (e.g., systemd) is configured.

Upgrade Velociraptor to version 0.77.2 or later, which contains the fix for the divide-by-zero bug in ShouldPadFile(). As interim workarounds, implement input validation to reject malformed sparse files before they reach the vulnerable function, and restrict file expansion operations in the GUI to trusted, authorized users only. Additionally, monitor server logs for panic events and configure process supervisors to alert on abnormal server terminations (GitHub Advisory, Velociraptor Advisory).