Velociraptor’s NTFS parsing library mishandles several out‑of‑bounds accesses and division‑by‑zero conditions that can be triggered by a maliciously crafted NTFS image. The resulting crash or uncontrolled memory allocation leads to a denial of service, and the library’s use of buffer reads without proper bounds checks is indicated by CWE‑125, CWE‑369, and CWE‑789.

Rapid7 Velociraptor includes the buggy NTFS parser. While the parser is normally used against live filesystems, it is also invoked in forensic modes such as the dead‑disk forensics feature, where untrusted image files can be loaded. No specific product version is listed, so any version containing the affected parser is potentially vulnerable.

The CVSS score of 6.2 signals a moderate risk. EPSS data is absent and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been documented. The attack requires that an adversary can supply a malicious NTFS volume to the parser, for example by uploading a crafted image into a forensic workflow or by directly feeding the image to a service that processes disk images. Successful exploitation results in an application crash or memory exhaustion but does not provide code execution or other advanced capabilities.