A local unprivileged user on Windows can trigger a heap buffer overflow when querying the processes table with a maliciously crafted entry. The overrun occurs in getProcessCurrentDirectory() because lengths read from the process command‑line and current‑directory fields in the PEB structure are unchecked. If an attacker forces the overflow, they could elevate from a standard user to SYSTEM, granting full system control.

Users running osquery versions earlier than 5.23.1 on Windows are affected. The heap overflow issue is fixed in version 5.23.1 and newer.

The CVSS score of 7.0 indicates high severity. The EPSS score of less than 1% shows a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits. The attack vector is local; exploitation requires a local user who can run osquery and execute a crafted query, potentially resulting in system‑wide privilege escalation if successful.