Velociraptor contains an out‑of‑bounds read in its prefetch parsing library, which can be triggered by specially crafted prefetch files. The flaw causes the client to crash when it attempts to read beyond allocated memory. The resulting denial of service is limited to the instance of the client and does not provide privilege escalation or remote code execution capabilities. The impact is primarily a loss of background collection service for the affected agent.

This vulnerability affects Rapid7’s Velociraptor product, which uses the go‑prefetch library for parsing Windows prefetch files. No specific product version range is disclosed, so any deployment that relies on the prefetch parser may be susceptible. The issue is present on any platform where Velociraptor parses prefetch files on the client side.

The CVSS score of 3.6 indicates low severity and the EPSS value is not available, suggesting an unlikely widespread exploitation. The flaw is not listed in CISA’s KEV catalog and no public exploits have been reported. Based on the description, the likely attack vector is delivery of a malformed prefetch file to a running client, which may occur through ingestion of external data or copying to a monitored network location. Because the flaw only triggers a crash, the risk to confidentiality or integrity is minimal, but repeated crashes may lead to denial of service under sustained attack.