EUVD-2026-42918Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStandard user logs into Windows host
-
DeliveryPlant maliciously crafted binary on disk
-
Exploitosquery authenticode query targets file
-
ExecutionMalformed publisher parsed in getOriginalProgramName
-
PersistHeap out-of-bounds write corrupts memory
-
ImpactCode execution as SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a local, already-authenticated standard user on a Windows host running osquery (PR:L), the ability to write a maliciously crafted binary to a location osquery can read, and a query of the authenticode table that targets that binary - the malicious publisher information is parsed by getOriginalProgramName during that query (UI:P, the query acts on the attacker's file). Limiting factors: it is Windows-only, needs local access rather than network reach, affects only osquery versions before 5.23.1, and depends on osquery actually running an authenticode query against the attacker-controlled file (e.g., a scheduled query or an operator running one); privilege escalation to SYSTEM only materializes when the osquery process is running with SYSTEM privileges. |
| Impact | The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H, base 7.0) is internally consistent with the description: local access, low complexity, low privileges already required, and passive user interaction (a query must reach the malicious binary), yielding high confidentiality/integrity/availability impact but no subsequent-system scope change. Real-world risk is bounded by the local attack vector and the dependency on osquery actually querying the authenticode table against the attacker's file - this is not a remotely reachable or network-wormable issue, so EPSS would be expected to be low. No KEV listing and no POC were provided, so this is a credible but not urgent-in-the-wild issue; priority rises sharply in environments that deploy osquery fleet-wide as a SYSTEM service and run scheduled authenticode queries. Missing signals: EPSS score and SSVC decision data were not supplied and cannot be inferred. |
| Exploit ScenarioDerived | A standard user drops a specially crafted signed (or malformed-signature) binary onto the host, then waits for-or induces-an osquery query against the authenticode table that targets that file, such as a fleet-wide scheduled query enumerating executables. Parsing the malicious publisher fields in getOriginalProgramName triggers the heap out-of-bounds write inside the SYSTEM-level osquery process, potentially yielding SYSTEM-level code execution. No public POC was provided, so exploitation is theoretical at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard user escalate to SYSTEM by planting a maliciously crafted binary and having the authenticode table query it, triggering a heap out-of-bounds write in the getOriginalProgramName publisher-parsing routine. The flaw is a CWE-122 heap buffer overflow reachable whenever osquery (typically running as SYSTEM) evaluates authenticode publisher metadata against attacker-controlled files. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS was not provided.
RemediationAI
Upgrade to the vendor-released patch: osquery 5.23.1 (https://github.com/osquery/osquery/releases/tag/5.23.1), which contains the fix (PR https://github.com/osquery/osquery/pull/8923, commit 59a808cda96d5a089cf6ec147efe152459284d54); see advisory GHSA-hr28-jvpx-68cx (https://github.com/osquery/osquery/security/advisories/GHSA-hr28-jvpx-68cx). Until patched, reduce exposure by avoiding or restricting scheduled and ad-hoc queries against the authenticode table on Windows endpoints, and by limiting where standard users can write executable files that osquery would enumerate (for example, tightening ACLs on user-writable directories); the trade-off is reduced code-signing visibility from osquery while the mitigation is in place. Because exploitation requires a local low-privileged foothold, standard endpoint hardening and least-privilege on where unprivileged users can drop binaries further limits reachability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
osquery is an open-source, SQL-driven operating-system instrumentation and monitoring framework (CPE cpe:2.3:a:osquery:osquery). On Windows it exposes an authenticode virtual table that inspects Portable Executable (PE) code-signing data. The defect lives in getOriginalProgramName, which parses Authenticode publisher/subject information embedded in a signed binary; malformed publisher fields cause a heap-based out-of-bounds write (CWE-122). Because the osquery agent frequently runs as a SYSTEM service and queries file metadata across the filesystem, corrupting its heap while it parses an attacker-supplied binary provides a path to code execution in that privileged context.
Know when Osquery gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local low-privileged user (PR:L, AV:L) needs a query to touch the malicious binary (UI:R); heap overflow in the SYSTEM process yields full C/I/A impact with no cross-system scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to publisher information parsing in getOriginalProgramName. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1.
Executive ViewAI
osquery on Windows versions prior to 5.23.1 contain a privilege escalation vulnerability allowing standard users to become system administrators. This enables unauthorized system control and disables endpoint monitoring on affected assets, compromising security infrastructure for organizations using this monitoring tool.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict standard user file system write permissions to prevent malicious binary placement, deploy endpoint detection and response (EDR) monitoring to detect privilege escalation attempts, isolate osquery agents in segmented network environments, disable authenticode table functionality if operational requirements permit.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
osquery before version 4.4.0 enables a privilege escalation vulnerability. Rated high severity (CVSS 8.2), this vulnerab
An issue was discovered in osquery. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, lo
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Rated medium severity (C
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard l
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard (unprivileged) user escalate to SYSTEM
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permiss
Exploit-DB