Velociraptor's NTFS parsing library mishandles several out-of-bounds read and memory exhaustion bugs that can be triggered by maliciously crafted NTFS images. While typical use on live NTFS filesystems limits exploitation opportunities, use cases involving untrusted NTFS image files (e.g., dead disk forensics) are vulnerable. An attacker able to supply corrupted NTFS volumes can cause the application to crash, resulting in denial of service. The CVSS 3.1 base score is 6.2 (medium severity) with attack vector local, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability. Affected versions are all versions prior to 0.77.2. No patch or official remediation level is currently documented.

Successful exploitation causes application crashes leading to denial of service. There is no reported impact on confidentiality or integrity of data. The vulnerability requires local access to supply malicious NTFS images and does not require user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted NTFS image files with Velociraptor or use alternative tools for dead disk forensics. Monitor vendor communications for updates on patches or mitigations.