TI-2023-02088 Aliases CVE-2023-2226 GHSA-97vg-58wg-32x4

Velociraptor crashes while parsing some malformed PE or OLE files.

LOW 24CWE-125Published 2023-04-21 · Updated 2025-02-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00384 32nd percentileScored 2026-11-07

Fix Fixed Velociraptor (Rapid7): 0.6.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rapid7	Velociraptor	before 0.6.8	0.6.8	Patch available	CNA

Velociraptor VendorRapid7 Affected before 0.6.8 Fixed in 0.6.8 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rapid7:velociraptor::::::::	before 0.6.8	Vulnerable	Rapid7

cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:* Versions before 0.6.8 Vulnerable ·Rapid7

Remediation

Fix · CNA Velociraptor (Rapid7) Fixed in 0.6.8

Timeline

2026-10-02 Threatist record created from CVE-2023-2226
2026-10-03 Alias added: GHSA-97vg-58wg-32x4

References

Other 1

https://github.com/Velocidex/velociraptor

TI-2023-05481 Rapid7 Velociraptor Reflected XSS CVSS 3.1HIGH 8.6
TI-2026-05514 Velociraptor Query() Plugin Misapplies Permissions To Orgs CVSS 3.1CRITICAL 9.1
TI-2026-04661 Rapid7 Velociraptor Improper Input Validation in Client Message Handler CVSS 3.1HIGH 8.5
TI-2023-00229 Insufficient permission check in the VQL copy() function CVSS 3.1HIGH 8.8
TI-2026-06659 GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations CVSS 3.1HIGH 7.7
TI-2025-13446 Rapid7 Velociraptor Directory Traversal Vulnerability CVSS 3.1MEDIUM 6.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences