osquery EUVD-2026-42919

Requires local code execution as a standard (unprivileged) user on a Windows host running a vulnerable osquery (<5.23.1); the attacker must be able to start a process and control its PEB command-line and current-directory string Length values. Exploitation is gated on the osquery agent - typically running as SYSTEM - actually executing a query against the Windows processes table that reaches the malicious process (the UI:P/passive requirement), so it only fires when such a query runs on a schedule, via a query pack, or through distributed/ad-hoc queries. Limiting factors: Windows-only, no remote or network vector, requires a pre-existing local foothold, requires osquery to be deployed and querying the processes table, and delivers escalation only up to SYSTEM (no subsequent-system/scope impact per SC:N/SI:N/SA:N).

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H, base 7.0) is internally consistent with the description: local vector, low attacker privileges required, and a passive user-interaction/context requirement (the SYSTEM-level osquery agent must run the process query). Impact is high across confidentiality, integrity, and availability on the vulnerable system, matching a standard-user-to-SYSTEM escalation. No EPSS score, KEV listing, or POC was provided, so real-world exploitation pressure appears low-to-moderate today: exploitation is gated on osquery actually being deployed AND periodically querying the processes table, which is common in security-monitoring deployments but not universal. This is a legitimate patch priority for environments running osquery on Windows as a SYSTEM service, but not an internet-facing, mass-exploitable issue - the local-only vector and dependency on the monitoring agent's scheduled queries meaningfully limit blast radius. Note the tension between raw impact (SYSTEM compromise) and low practical reachability (requires local foothold plus a triggering query), so prioritize based on osquery deployment rather than CVSS number alone.

A standard-user attacker with an interactive or code-execution foothold on a Windows host launches a process whose PEB command-line or current-directory UNICODE_STRING Length fields are set to oversized values. When the osquery agent (running as SYSTEM) next executes a scheduled or distributed query against the processes table, it reads those crafted lengths and performs a heap out-of-bounds write, which a skilled attacker can shape into code execution in the SYSTEM context. No public POC has been identified, and the local vector plus low complexity make this feasible for an attacker who already has a foothold and can wait for or induce a process query.