CVE-2026-54001: 
OSQuery vulnerability analysis and mitigation

CVE-2026-54001 is a heap-based buffer overflow vulnerability in osquery's Windows authenticode table that can allow a local unprivileged attacker to escalate privileges to SYSTEM. It affects all osquery versions prior to 5.23.1 on Windows. The vulnerability was published on July 10, 2026, with the fix merged on June 23, 2026, and released in osquery 5.23.1 on June 24, 2026. It carries a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause is a heap-based buffer overflow (CWE-122) in the getOriginalProgramName function within osquery/tables/system/windows/authenticode.cpp. In the vulnerable code, the second call to CryptDecodeObject incorrectly passed publisher_info_ptr (a pointer into the caller's signer_information buffer) as the output buffer instead of publisher_info_blob_ptr (the correctly-sized buffer allocated for the decode output). A crafted PE file with a large SPC_SP_OPUS_INFO attribute could cause CryptDecodeObject to write past the end of the signer info buffer, corrupting adjacent heap memory. Exploitation requires a local attacker to place a maliciously crafted binary on the system and trigger an osquery authenticode table query against it — either by waiting for a scheduled query or by influencing query execution. The fix replaces the two-call CryptDecodeObject pattern with a single CryptDecodeObjectEx call using CRYPT_DECODE_ALLOC_FLAG, delegating buffer allocation to the CryptoAPI and making the wrong-output-buffer class of bug structurally impossible (GitHub PR #8923, GitHub Commit).

Successful exploitation could allow a local standard user to escalate privileges to SYSTEM on Windows hosts running osquery. The heap corruption resulting from the out-of-bounds write affects confidentiality, integrity, and availability at the vulnerable system level (all rated High in CVSS v4.0). Because osquery is commonly deployed as a privileged monitoring agent, a successful privilege escalation could give an attacker full control of the endpoint, enabling lateral movement, credential harvesting, or persistent access (GitHub Advisory, Feedly).

As of the time of publication, there are no known exploits or in-the-wild exploitation of CVE-2026-54001 (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score is approximately 0.108%, indicating a low probability of near-term exploitation (Feedly). Exploitation is not automatable (per SSVC assessment) and requires local access plus user interaction (passive), limiting the attack surface to scenarios where an attacker can place a crafted binary and influence osquery query execution.

1. Gain local access: Obtain a foothold on a Windows system running osquery prior to version 5.23.1 as a standard (unprivileged) user.
2. Craft a malicious PE binary: Create a Windows PE (Portable Executable) file with a specially crafted, oversized SPC_SP_OPUS_INFO attribute in its Authenticode signature structure. The oversized attribute is designed to cause CryptDecodeObject to write beyond the bounds of the allocated signer information buffer when parsed by osquery.
3. Place the binary on the target system: Write the crafted PE file to a location accessible on the filesystem (e.g., a user-writable directory such as %TEMP% or %APPDATA%).
4. Trigger an authenticode table query: Wait for or influence osquery to execute a query against the authenticode table targeting the malicious binary (e.g., via a scheduled osquery pack query that scans directories containing the crafted file, or by placing the file in a path covered by an existing query).
5. Heap corruption and privilege escalation: When osquery's getOriginalProgramName function processes the crafted binary, the out-of-bounds write corrupts adjacent heap memory in the osquery process (which runs as SYSTEM). A successful exploit leverages this corruption to achieve code execution in the SYSTEM context (GitHub PR #8923, GitHub Advisory).

• File System: Presence of unsigned or anomalously signed PE files in user-writable directories (e.g., %TEMP%, %APPDATA%, %LOCALAPPDATA%) with unusually large SPC_SP_OPUS_INFO Authenticode attributes.
• Logs: osquery logs showing crashes, unexpected process termination, or errors related to authenticode table queries; Windows Event Log entries (e.g., Event ID 1000/1001) indicating osquery process crashes or application faults.
• Process: Unexpected child processes or threads spawned by the osquery service process (osqueryd.exe) running under the SYSTEM account; unusual SYSTEM-level process activity originating from osquery.
• Network: Outbound connections from osqueryd.exe to unexpected external hosts, which may indicate post-exploitation activity following a successful privilege escalation.

Upgrade osquery to version 5.23.1 or later, which contains the fix for this vulnerability (osquery Release 5.23.1). As a temporary workaround if patching is not immediately practical, disable or remove any osquery queries that target the authenticode table on Windows systems (GitHub Advisory). Additionally, restrict write access to directories scanned by osquery authenticode queries to limit an attacker's ability to place a crafted binary in a queried path.

The vulnerability was disclosed via a GitHub Security Advisory (GHSA-hr28-jvpx-68cx) published by osquery maintainer zwass on July 1, 2026. The fix was developed by contributor directionless and reviewed by core maintainers, with the PR noting that the bug also caused original_program_name to be silently empty for all signed binaries — a latent correctness bug in addition to the security issue (GitHub PR #8923). A Korean-language threat intelligence report referencing the CVE was noted in the osquery pull request, suggesting some community awareness in the security research space (GitHub PR #8923).