EUVD-2026-42919Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local standard-user access (PR:L) with a triggering process query needed (UI:R); SYSTEM-level heap write yields high C/I/A; scope kept S:U to match vendor SC/SI/SA:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the processes table targeting a maliciously crafted process, due to unchecked PEB string lengths in process command-line and current-directory reads. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1.
AnalysisAI
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard (unprivileged) user escalate to SYSTEM by planting a maliciously crafted process whose Process Environment Block (PEB) contains oversized command-line or current-directory strings. When the osquery agent - typically running as SYSTEM - queries the processes table against that process, unchecked PEB string lengths trigger a heap-based out-of-bounds write (CWE-122). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
osquery exposes operating-system state as SQL-queryable virtual tables; the Windows processes table enriches each row with a process's command line and current working directory. On Windows these values are not exposed directly but read out of the target process's Process Environment Block (PEB) - specifically the RTL_USER_PROCESS_PARAMETERS UNICODE_STRING fields, where each string carries an attacker-influenceable Length field. The affected component (cpe:2.3:a:osquery:osquery) trusts those PEB-supplied lengths without bounds-validating them before copying into a heap buffer, so a process crafted with inflated Length values produces a heap out-of-bounds write. CWE-122 (heap-based buffer overflow) captures the root cause: a length/size value taken from untrusted input drives a memory copy into an undersized heap allocation.
RemediationAI
Vendor-released patch: 5.23.1 - upgrade all Windows osquery deployments to 5.23.1 or later, which adds bounds checking on the PEB string lengths (see commit 3d457c412eb0c986b0c37d8903edae8bc9f9e246 via PR https://github.com/osquery/osquery/pull/8934 and advisory https://github.com/osquery/osquery/security/advisories/GHSA-4r78-6hg6-33gg). Where immediate upgrade is not possible, the practical compensating control is to stop or restrict queries against the processes table on Windows endpoints - remove processes from scheduled query packs and any ad-hoc/distributed query paths, since the out-of-bounds write is only triggered when osquery reads a crafted process's command-line/current-directory fields; the trade-off is loss of process-inventory telemetry that many detections rely on. Additionally limit which users can create arbitrary processes on sensitive hosts and monitor for anomalous osquery crashes (which may indicate exploitation attempts). Do not rely on the workaround long-term, as it disables a core monitoring capability.
osquery before version 4.4.0 enables a privilege escalation vulnerability. Rated high severity (CVSS 8.2), this vulnerab
An issue was discovered in osquery. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, lo
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Rated medium severity (C
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard l
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard user escalate to SYSTEM by planting a m
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permiss
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today