CVE-2026-17535 Overview
CVE-2026-17535 affects Velociraptor's New Technology File System (NTFS) parsing library. The parser mishandles several out-of-bounds and memory exhaustion conditions triggered by maliciously crafted NTFS images. Attackers who supply a corrupted NTFS volume can crash the parser and cause a denial of service.
Velociraptor typically parses live NTFS filesystems, which limits attacker control over the input. However, dead disk forensics workflows process untrusted NTFS image files, exposing the parser to attacker-supplied data. The vulnerability is classified under [CWE-125] Out-of-Bounds Read.
Critical Impact
An attacker who can supply a crafted NTFS image to Velociraptor during dead disk forensics can crash the parser process and disrupt forensic operations.
Affected Products
- Velociraptor digital forensics and incident response platform
- Velociraptor NTFS parsing library used in dead disk forensics workflows
- Deployments processing untrusted NTFS image files
Discovery Timeline
- 2026-08-11 - CVE-2026-17535 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-17535
Vulnerability Analysis
The flaw resides in Velociraptor's NTFS parsing library. The parser fails to validate structural fields within NTFS volume metadata before dereferencing offsets or allocating memory. A crafted image can push reads beyond allocated buffers or request allocations large enough to exhaust available memory.
The consequence is a process crash rather than code execution. The Exploit Prediction Scoring System places this issue in the low-probability range, consistent with a local denial-of-service condition that requires attacker-supplied input to the parser.
Root Cause
The NTFS parser trusts length fields, offsets, and record counts read from disk structures without bounds validation. Malformed Master File Table (MFT) entries, attribute headers, or index records can trigger reads past buffer boundaries, mapped as [CWE-125]. Separate paths accept size fields that drive unbounded allocations, producing memory exhaustion.
Attack Vector
Exploitation requires an attacker to place a malicious NTFS image where Velociraptor will parse it. The intended attack path is dead disk forensics, where an analyst loads an evidence image from an untrusted source. Live NTFS parsing on running endpoints is largely unaffected because attackers cannot arbitrarily corrupt the mounted volume structures the parser reads.
The vulnerability requires local access to submit the crafted image and no privileges or user interaction beyond initiating the forensic task. See the Velociraptor Security Advisory for technical details on the affected parsing paths.
Detection Methods for CVE-2026-17535
Indicators of Compromise
- Unexpected termination of the Velociraptor process during NTFS image analysis or dead disk forensic collection
- Crash logs referencing the NTFS parser call path following ingestion of an external disk image
- Sudden memory consumption spikes on the host running Velociraptor when processing a supplied NTFS volume
Detection Strategies
- Monitor Velociraptor server and client logs for parser exceptions, panics, or abrupt exits correlated with disk image ingestion
- Track process telemetry for Velociraptor workers that exceed baseline memory allocation during forensic tasks
- Audit which users or automated workflows submit NTFS images to Velociraptor and flag submissions from untrusted origins
Monitoring Recommendations
- Enable verbose logging on Velociraptor dead disk forensic operations to capture parser errors
- Alert on repeated Velociraptor process restarts occurring during evidence processing
- Record the provenance and hash of every NTFS image submitted to the platform for retrospective analysis
How to Mitigate CVE-2026-17535
Immediate Actions Required
- Upgrade Velociraptor to the fixed release identified in the vendor advisory
- Restrict dead disk forensics operations to trusted analysts and validated evidence sources
- Verify hashes and chain of custody for NTFS images before parsing with Velociraptor
Patch Information
Refer to the Velociraptor Security Advisory for the fixed version and release notes. Apply the update to all Velociraptor servers and clients that perform NTFS parsing, particularly systems used for dead disk forensics.
Workarounds
- Avoid processing NTFS images from untrusted sources until the patch is applied
- Run dead disk forensics inside isolated virtual machines or containers to contain crashes and resource exhaustion
- Apply resource limits (memory and CPU quotas) to Velociraptor processes performing image analysis
- Prefer live NTFS parsing on managed endpoints where attacker control over filesystem structures is limited
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
