CVE-2026-46388
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In osquery prior to version 5.23.1, an unprivileged attacker can read the contents of files during an ongoing file carve because temporary directories are not created with private permissions. If the carve targets a directory controlled by the attacker, arbitrary file reads are possible, including sensitive local files.
Risk Assessment
The risk involves potential leakage of sensitive system data or configuration files, which could lead to privilege escalation or system integrity compromise.
Recommendation
Immediately update osquery to version 5.23.1 or later, which contains the security fix.
Other vulnerabilities in osquery
See all- CVE-2026-54001High
On Windows, prior to version 5.23.1, a local unprivileged attacker can trigger a heap buffer out-of-bounds write when querying the authenticode table against a maliciously crafted binary. The vulnerability stems from publisher information parsing in the getOriginalProgramName function.
- CVE-2026-54000High
In osquery prior to version 5.23.1 on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write when querying the processes table for a maliciously crafted process. The vulnerability is due to unchecked PEB string lengths in process command-line and current-directory reads.
Original NVD description (English source)
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.