CVE-2026-54000: 
OSQuery vulnerability analysis and mitigation

CVE-2026-54000 is a heap-based buffer overflow vulnerability in osquery's Windows processes table that allows a local unprivileged attacker to potentially escalate privileges to SYSTEM. It affects all osquery versions prior to 5.23.1 on Windows. The vulnerability was reported by Mike Myers (Apple) and fixed in osquery 5.23.1, released on June 24, 2026, with the security advisory published on July 1, 2026. It carries a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, EUVD).

The root cause is an unchecked UNICODE_STRING::Length field (CWE-122: Heap-based Buffer Overflow) read from a target process's Process Environment Block (PEB) in osquery/tables/system/windows/processes.cpp. The functions getProcessCommandLineLegacy() and getProcessCurrentDirectory() allocate a fixed kMaxPathSize (4096 wchar_t = 8192 bytes) heap buffer, then call ReadProcessMemory() using the Length field of a UNICODE_STRING sourced directly from the target process's RTL_USER_PROCESS_PARAMETERS. Since Length is a USHORT (up to 65,535 bytes) and an unprivileged local attacker controls their own PEB, they can set this value to trigger a heap OOB write of up to ~57KB when osqueryd (running as SYSTEM) queries the processes table. macOS and Linux are unaffected because those platforms retrieve command-line and current-directory data through kernel-mediated interfaces (sysctl/proc_pidinfo and procfs, respectively) (GitHub PR #8934, GitHub Advisory).

Successful exploitation enables a local standard user to achieve local privilege escalation to SYSTEM on Windows hosts running osquery. The heap OOB write of up to ~57KB can corrupt heap metadata or adjacent allocations in the osqueryd process (which runs as SYSTEM), potentially enabling arbitrary code execution in the SYSTEM context. This grants full control over the affected host, including access to all credentials, sensitive data, and the ability to disable security tooling or move laterally within the environment (GitHub Advisory, GitHub PR #8934).

There are no known public exploits or in-the-wild exploitation at the time of publication, as confirmed by the osquery security advisory (GitHub Advisory). The NVD SSVC assessment also indicates exploitation status as "none" (Feedly). The EPSS score is approximately 0.108%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and passive user interaction (a query of the processes table must occur), limiting its attack surface.

1. Gain local unprivileged access: Obtain a standard (non-administrator) user account on a Windows system running osqueryd as SYSTEM.
2. Craft a malicious process: Launch a process under the attacker's account and manipulate its own RTL_USER_PROCESS_PARAMETERS in the PEB — specifically, set CommandLine.Length and/or CurrentDirectoryPath.Length to the maximum USHORT value (65,535) while pointing the Buffer field to attacker-controlled data.
3. Wait for or trigger a processes table query: osqueryd periodically queries the processes table as part of scheduled queries, or an administrator may manually trigger such a query. When osqueryd reads the malicious process's PEB, it uses the attacker-controlled Length value (up to 65,535 bytes) as the size argument to ReadProcessMemory() into an 8,192-byte heap buffer.
4. Trigger heap OOB write: The unclamped ReadProcessMemory() call writes up to ~57KB beyond the allocated buffer in osqueryd's heap, corrupting adjacent heap structures.
5. Achieve SYSTEM code execution: By carefully shaping the heap layout, an attacker may redirect execution flow within the SYSTEM-privileged osqueryd process, achieving local privilege escalation to SYSTEM (GitHub PR #8934, GitHub Advisory).

• Process: Unusual child processes or threads spawned by osqueryd.exe running as SYSTEM; unexpected SYSTEM-level processes originating from a standard user session.
• Logs: osquery logs showing errors or crashes in the processes table query on Windows; Windows Event Log entries (e.g., Event ID 1000/1001) indicating application crashes or faults in osqueryd.exe.
• File System: Unexpected files written by osqueryd.exe or SYSTEM-level processes to user-accessible directories; new scheduled tasks or services created under SYSTEM context without administrative action.
• Network: Outbound connections from osqueryd.exe to unexpected external hosts, which may indicate post-exploitation activity following privilege escalation.

Upgrade osquery to version 5.23.1 or later, which clamps the PEB-sourced UNICODE_STRING::Length to the destination buffer size before passing it to ReadProcessMemory() via the new clampPebReadLength() helper (osquery Release 5.23.1, GitHub Commit). If immediate patching is not feasible, the vendor recommends disabling queries to the processes table on Windows as a temporary workaround (GitHub Advisory). Only Windows deployments are affected; macOS and Linux osquery installations do not require remediation for this specific issue.