An unprivileged user running osquery can read the temporary files created during a file carve operation before the carve process finishes and the files are removed. The reading window is limited to the duration of the carve, but during that time the user can exfiltrate any data stored in the carve directory, including sensitive local files if the attacker controls the target directory. This vulnerability is caused by insufficient access control on temporary carve directories (CWE‑279), a timestamp race that can lead to undefined behavior (CWE‑378), and an ordinal race condition (CWE‑379).

All installations of osquery older than version 5.23.1 are affected. The issue is present in every build that creates carve‑wise temporary directories without setting the mode to private or otherwise restricting access. The warning remediation was incorporated starting with osquery 5.23.1.

The CVSS score is 4.4, indicating a low impact. The EPSS score is less than 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it was not actively exploited at the time of analysis. The likely attack vector is osquery as an unprivileged user may create a carve that points to a directory they can control, read the temporary files while the carve is in progress, and retrieve sensitive data until the carve completes.