CVE-2026-17535

This CVE exposes a threat model mismatch rather than a straightforward coding error. Velociraptor's NTFS parser was architected for live filesystem analysis — a context where the operating system presents files as trustworthy. Dead disk forensics breaks that assumption fundamentally: the parser now ingests arbitrary image files from untrusted sources. The code was correct for its intended context; it simply wasn't designed for the expanded use case, and no internal review caught the gap. The CVSS of 6.2 reflects yesterday's threat landscape — a specialized attack surface requiring an analyst to manually open a malicious image. That constraint is eroding. Automated forensic pipelines increasingly ingest untrusted images as part of SOC triage workflows, meaning a malformed NTFS volume doesn't just crash one tool; it breaks the correlation chain, destroys the evidence trail for downstream tools, and creates cascading failures that CVSS doesn't capture. What you should do: audit your forensic automation pipelines for tools processing untrusted disk images and treat every file format parser in that chain as potentially adversarial. Prioritize patching forensic tooling that operates in automated workflows — the operational tolerance that makes incident responders delay patching is precisely what makes automated pipelines vulnerable to cascading DoS. The fix to the NTFS parser is necessary but insufficient; the real exposure is in how many other parsers in your tooling stack were never fuzzed against malicious input and are now silently processing untrusted artifacts in production pipelines.

Reviewed through automated stages and approved by a human before publication.