CVE-2026-77797: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-77797 is an out-of-bounds read vulnerability in Velociraptor's prefetch library (go-prefetch) that may cause a crash when parsing certain malformed prefetch files. It affects Rapid7 Velociraptor versions prior to 0.77.3. The vulnerability was published on September 24, 2026, with a patch released the same day. It carries a CVSS v3.1 base score of 3.6 (Low) (GitHub Advisory, Velociraptor Advisory).

The root cause is improper input validation (CWE-20) combined with an out-of-bounds read (CWE-125) in the Windows LZXpress Huffman decompressor within the go-prefetch library. Specifically, the LZXpressHuffmanDecompressWithFallback function failed to check for zero-length input or zero output size before processing, allowing a crafted malformed prefetch file to trigger an overflow condition and crash the parser. The fix, committed to the Velocidex/go-prefetch repository, adds a guard clause that returns early when len(input) == 0 or output_size == 0 (GitHub Commit). Exploitation requires local access and user interaction (e.g., Velociraptor parsing a prefetch file supplied or placed by an attacker), making it a low-severity, locally-scoped issue.

Successful exploitation causes a crash in Velociraptor's prefetch parsing functionality, resulting in a denial-of-service condition for that component. There is no confidentiality impact, and integrity impact is rated low (scope changed), meaning the crash could affect components beyond the immediate parsing library. The vulnerability does not enable remote code execution or data exfiltration, and its impact is limited to disrupting prefetch file analysis on the affected host (GitHub Advisory, Velociraptor Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.105% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD's SSVC assessment classifies exploitation as "none" and automation as "no" (Feedly).

Upgrade Velociraptor to version 0.77.3 or later, which includes the patched go-prefetch library with the overflow guard fix (Velociraptor Advisory, GitHub Commit). As interim mitigations, restrict access to prefetch file parsing functionality to trusted sources and implement input validation for prefetch files before they are processed by Velociraptor. Given the low severity and local-only attack vector, prioritization should be based on the sensitivity of the environment where Velociraptor is deployed.