CVE-2026-54001
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
On Windows, prior to version 5.23.1, a local unprivileged attacker can trigger a heap buffer out-of-bounds write when querying the authenticode table against a maliciously crafted binary. The vulnerability stems from publisher information parsing in the getOriginalProgramName function.
Risk Assessment
Successful exploitation could allow privilege escalation from a standard user to SYSTEM, granting the attacker full control over the system.
Recommendation
Immediately upgrade osquery to version 5.23.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in osquery
See all- CVE-2026-54000High
In osquery prior to version 5.23.1 on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write when querying the processes table for a maliciously crafted process. The vulnerability is due to unchecked PEB string lengths in process command-line and current-directory reads.
- CVE-2026-46388Medium
In osquery prior to version 5.23.1, an unprivileged attacker can read the contents of files during an ongoing file carve because temporary directories are not created with private permissions. If the carve targets a directory controlled by the attacker, arbitrary file reads are possible, including sensitive local files.
Original NVD description (English source)
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to publisher information parsing in getOriginalProgramName. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1.