ntfsDump

ntfsDump Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. Similar to https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1 Reference:https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib...

EUVD-2026-56180

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However...

EUVD-2026-56153

Velociraptor's VQL has a query plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission usually only given to administrators. Velociraptor versions prior to 0.77.2 evaluate this...

PT-2026-70212

Name of the Vulnerable Software and Affected Versions Velociraptor affected versions not specified Description The NTFS parsing library contains multiple out-of-bounds and memory exhaustion bugs. These issues can be triggered when the software processes maliciously crafted NTFS images, such as...

CVE-2025-22831 Buffer Overflow in NTFS when parsing the VOLUME_NAME

APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability...