CVE-2026-64951

{"id": "CVE-2026-64951", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64951", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T12:28:55.260841Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T10:17:20.063", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-64951/", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-369"}]}], "descriptions": [{"lang": "en", "value": "A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process.\n\nThe problem is a Divide by Zero bug in the\u00a0ShouldPadFile() function."}, {"lang": "es", "value": "Un cliente Velociraptor malicioso puede cargar un archivo disperso malformado de tal manera que, si la GUI intenta expandir el archivo, se produce un p\u00e1nico que puede bloquear el proceso del servidor.\n\nEl problema es un error de divisi\u00f3n por cero en la funci\u00f3n ShouldPadFile()."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cve@rapid7.com"}