EUVD-2026-42918Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privileged user (PR:L, AV:L) needs a query to touch the malicious binary (UI:R); heap overflow in the SYSTEM process yields full C/I/A impact with no cross-system scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to publisher information parsing in getOriginalProgramName. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1.
AnalysisAI
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard user escalate to SYSTEM by planting a maliciously crafted binary and having the authenticode table query it, triggering a heap out-of-bounds write in the getOriginalProgramName publisher-parsing routine. The flaw is a CWE-122 heap buffer overflow reachable whenever osquery (typically running as SYSTEM) evaluates authenticode publisher metadata against attacker-controlled files. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
osquery is an open-source, SQL-driven operating-system instrumentation and monitoring framework (CPE cpe:2.3:a:osquery:osquery). On Windows it exposes an authenticode virtual table that inspects Portable Executable (PE) code-signing data. The defect lives in getOriginalProgramName, which parses Authenticode publisher/subject information embedded in a signed binary; malformed publisher fields cause a heap-based out-of-bounds write (CWE-122). Because the osquery agent frequently runs as a SYSTEM service and queries file metadata across the filesystem, corrupting its heap while it parses an attacker-supplied binary provides a path to code execution in that privileged context.
RemediationAI
Upgrade to the vendor-released patch: osquery 5.23.1 (https://github.com/osquery/osquery/releases/tag/5.23.1), which contains the fix (PR https://github.com/osquery/osquery/pull/8923, commit 59a808cda96d5a089cf6ec147efe152459284d54); see advisory GHSA-hr28-jvpx-68cx (https://github.com/osquery/osquery/security/advisories/GHSA-hr28-jvpx-68cx). Until patched, reduce exposure by avoiding or restricting scheduled and ad-hoc queries against the authenticode table on Windows endpoints, and by limiting where standard users can write executable files that osquery would enumerate (for example, tightening ACLs on user-writable directories); the trade-off is reduced code-signing visibility from osquery while the mitigation is in place. Because exploitation requires a local low-privileged foothold, standard endpoint hardening and least-privilege on where unprivileged users can drop binaries further limits reachability.
osquery before version 4.4.0 enables a privilege escalation vulnerability. Rated high severity (CVSS 8.2), this vulnerab
An issue was discovered in osquery. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, lo
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Rated medium severity (C
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard l
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard (unprivileged) user escalate to SYSTEM
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permiss
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today