Technical impact
A local unprivileged user on Windows can trigger a heap buffer overflow when querying the processes table in osquery. The overflow occurs in getProcessCurrentDirectory() because the lengths of the process command‑line and current‑directory strings in the PEB structure are not validated before use. If an attacker forces the overflow, it can enable a privilege escalation from standard user level to SYSTEM, giving the attacker full control of the machine. This flaw is a classic heap-based buffer overflow (CWE-122).
Affected Systems
Versions of osquery earlier than 5.23.1 running on Windows are affected. The issue was addressed in the 5.23.1 release and applies to all builds that include the processes table on Windows.
Risk and Exploitability
The CVSS score of 7.0 places the vulnerability in the high‑severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, meaning no public exploits are known. The attack vector is local; an attacker must have the ability to run osquery and execute a crafted query. Successful exploitation could result in complete system‑wide privilege escalation to SYSTEM if the attacker is able to trigger the buffer overflow.
