Description

A rogue Velociraptor client can upload a malformed sparse file such that if the GUI attempts to expand the file, a panic occurs which may crash the server process. The problem is a Divide by Zero bug in the ShouldPadFile() function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-12T10:17:20.063Z",
  "pubdate": "2026-08-12T10:17:20.063Z",
  "executiveSummary": "A denial of service vulnerability exists within the Velociraptor client-server architecture, specifically involving the handling of sparse file uploads. The vulnerability is classified as a divide-by-zero error, triggered during the execution of the ShouldPadFile() function when the graphical user interface attempts to expand a maliciously crafted sparse file uploaded by a rogue client. Successful exploitation of this flaw leads to an application panic, resulting in the abrupt termination of the server process and causing a denial of service for all dependent users and monitoring operations. The risk implication is high regarding operational availability, as an authenticated or interacting rogue client can repeatedly crash the central management infrastructure with minimal computational overhead. Exploitation requires the ability to interact with the Velociraptor server by uploading a specifically formatted malformed sparse file, which is subsequently processed and visualized or expanded by administrative components within the GUI. No specific version numbers or external exploit requirements beyond client access and GUI interaction are detailed in the standard context.",
  "technicalDetails": "The root cause of the vulnerability resides in the ShouldPadFile() function, which fails to properly sanitize or validate the structural metadata of uploaded sparse files. Specifically, mathematical operations performed within ShouldPadFile() encounter a divisor of zero when processing the malformed sparse file dimensions or offsets provided by the rogue client. When the Velociraptor GUI subsequently attempts to parse, expand, or render the file based on these parameters, the unchecked arithmetic operation triggers a runtime panic in the underlying execution environment.\nThe attack flow proceeds as follows: First, an attacker operating a rogue or compromised Velociraptor client crafts a malformed sparse file containing anomalous header data or sparse block attributes designed to induce a zero-value denominator during calculation. Second, the client uploads this crafted file to the Velociraptor server through standard operational channels. Third, an administrator or automated GUI component interacts with the uploaded file, initiating a routine that calls ShouldPadFile() to evaluate padding requirements. Fourth, the execution of ShouldPadFile() attempts an illegal division by zero, causing an unrecovered runtime panic that immediately terminates the server process. This results in an immediate denial of service, halting all telemetry collection, incident response functions, and client management capabilities until the server process is manually or automatically restarted."
}