CVE-2026-77797: rapid7 velociraptor Improper Input Validation
CVSS: 3.6v3.1LowAwaiting analysis
Published 24-09-2026Last modified 29-09-2026
Vulnerability summary
CVE-2026-77797 is a low (CVSS 3.6) Improper Input Validation vulnerability in rapid7 velociraptor. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 1% of scored vulnerabilities.
CVSS score
3.6/10
010
Low · v3.1 (CVE.org)EPSS score
0.10%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 24-09-2026PublishedVulnerability first disclosed.
- 29-09-2026Last modifiedVulnerability information updated.
Description
Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files.
CVSS metrics
2 scores · 2 sources · 1 versionLow 3.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NSourcesAll 2 agree
- NVDNIST3.6LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.10%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
25-09-202621-10-2026
EPSS score0.10%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Rapid71 product
- velociraptor< 0.77.3
1 vendor · 1 product