CVE-2026-64951CWE-369

CVE-2026-64951

Low · published August 12, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.

The problem is a Divide by Zero bug in the ShouldPadFile() function.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-369 · Divide By Zero
Published
2026-08-12T14:17Z
References (1)
http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/ · [email protected]
EPSS history
Timeline
  • 12 AUG 09:49Z
    Velociraptor DoS triggered by Divide by Zero panic
    cvelistv5