Executive brief
osquery is a tool used by security and IT teams to monitor and analyze the state of operating systems. A vulnerability in the Windows version allows a standard user to gain full administrative (SYSTEM) control of the computer. This occurs when osquery attempts to inspect a specially crafted malicious process, leading to a memory error that can be exploited to take over the system.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Windows implementation of the osquery 'processes' table. The functions 'getProcessCommandLineLegacy()' and 'getProcessCurrentDirectory()' in 'processes.cpp' allocate a fixed 8192-byte buffer but use the 'Length' field from a target process's Process Environment Block (PEB) without validation when calling 'ReadProcessMemory()'. Since an attacker can manipulate the 'Length' field (a USHORT up to 65535 bytes) in their own process, they can trigger an out-of-bounds write of approximately 57KB. This can be leveraged for local privilege escalation (LPE) to SYSTEM when the osquery daemon (running with high privileges) queries the malicious process. The fix in version 5.23.1 introduces length clamping before the memory read operation.
Affected products
- osquery osquery < 5.23.1
Timeline
- 2026-06-11: other: Fix PR submitted on GitHub
- 2026-06-24: patched: Version 5.23.1 released
- 2026-07-01: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE published to NVD