A heap buffer overflow is triggered in osquery on Windows when a query accesses the authenticode table containing a maliciously crafted binary. During publisher information parsing in the getOriginalProgramName function the code writes beyond the intended memory bounds. This improper bounds checking (CWE-122) can allow an attacker with a standard user account to acquire SYSTEM privileges if the overflow is successfully exploited, effectively enabling local privilege escalation.

The issue affects Windows installations of osquery running any version earlier than 5.23.1 that have the authenticode table feature enabled. The vulnerability is resolved in version 5.23.1 and later. Users operating older releases are exposed regardless of other system patches.

The CVSS score of 7 indicates moderate severity, but the exploit requires local access: the attacker must be able to execute osquery queries on the target system. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been observed. Consequently, the risk is significant only in environments where unprivileged users can run arbitrary osquery queries that reference the authenticode table.