CVE-2026-54001: osquery Privilege Escalation Vulnerability

CVE-2026-54001 Overview

CVE-2026-54001 is a heap buffer out-of-bounds write vulnerability [CWE-122] in osquery, a SQL-powered operating system instrumentation, monitoring, and analytics framework. The flaw exists on Windows in the getOriginalProgramName function used by the authenticode table. A local unprivileged attacker who supplies a maliciously crafted binary can trigger the corruption when osquery parses its publisher information. Successful exploitation can escalate privileges from a standard user to SYSTEM. The issue is fixed in osquery version 5.23.1.

Critical Impact
Local privilege escalation from a standard user account to SYSTEM on Windows hosts running vulnerable osquery deployments that query the authenticode table.

Affected Products

osquery on Windows prior to version 5.23.1
Deployments querying the authenticode table against attacker-controlled file paths
osquery agents running with elevated privileges (typical enterprise fleet configuration)

Discovery Timeline

2026-07-10 - CVE-2026-54001 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-54001

Vulnerability Analysis

The vulnerability resides in osquery/tables/system/windows/authenticode.cpp, specifically in the getOriginalProgramName function. This function parses publisher information embedded in a Portable Executable (PE) file's Authenticode signature. When osquery evaluates a SQL query against the authenticode table, it opens the target binary and extracts signature metadata for the caller.

The legacy parsing logic manually walked publisher information structures without adequate bounds validation. A binary crafted with malformed publisher fields causes the parser to write past the end of a heap-allocated buffer. Because osquery typically runs as a Windows service under SYSTEM, the resulting memory corruption executes in the security context of that service rather than the querying user.

Root Cause

The root cause is unsafe manual decoding of Authenticode publisher data structures. The parser trusted length and offset fields from the untrusted binary. This produced a classic heap-based out-of-bounds write [CWE-122]. The upstream fix replaces the hand-rolled logic with the Windows CryptDecodeObjectEx API, which performs structural validation before returning parsed data.

Attack Vector

Exploitation requires local access and user interaction with the vulnerable code path. A standard user drops a malicious binary in a location that will be queried, then waits for or triggers an authenticode query against that path. Because osquery agents commonly execute scheduled queries as SYSTEM, the memory corruption yields privilege escalation rather than only crashing the user's session.

cpp

// Patch excerpt: osquery/tables/system/windows/authenticode.cpp
// Switch authenticode getOriginalProgramName to CryptDecodeObjectEx (#8923)
 #include <iomanip>
 // clang-format on
 
+#include <osquery/core/tables.h>
 #include <osquery/filesystem/filesystem.h>
 #include <osquery/logger/logger.h>
 #include <osquery/sql/sql.h>
-#include <osquery/core/tables.h>
 #include <osquery/utils/conversions/tryto.h>
 #include <osquery/utils/conversions/windows/strings.h>

Source: osquery commit 59a808c

Detection Methods for CVE-2026-54001

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries for the osqueryd.exe service process on endpoints running versions prior to 5.23.1
Presence of unsigned or malformed PE files in user-writable directories that appear in osquery scheduled query paths
New or unexpected child processes spawned by osqueryd.exe running as NT AUTHORITY\SYSTEM

Detection Strategies

Inventory osquery agent versions across the fleet and flag any host running a version earlier than 5.23.1
Review scheduled queries and packs that reference the authenticode table and identify those that operate on user-writable paths
Correlate osqueryd.exe service failures with recent file creation events by non-administrative users in the queried directories

Monitoring Recommendations

Monitor process lineage for osqueryd.exe and alert on unusual child processes or token elevation events
Track write operations to directories referenced by authenticode queries and alert when standard users introduce new PE files
Ingest osquery watchdog and Windows Application logs into a central SIEM to detect repeated agent crashes indicative of exploitation attempts

How to Mitigate CVE-2026-54001

Immediate Actions Required

Upgrade all Windows osquery agents to version 5.23.1 or later using the official release from the osquery project
Audit query packs and remove or restrict authenticode queries that target user-writable file paths until patching is complete
Restrict local user ability to write executables to directories inspected by osquery through NTFS ACLs and AppLocker or Windows Defender Application Control

Patch Information

The fix is available in osquery release 5.23.1 and was merged via pull request 8923. Full technical context is provided in the GitHub Security Advisory GHSA-hr28-jvpx-68cx. The patch replaces custom publisher parsing with the Windows CryptDecodeObjectEx API.

Workarounds

Remove or disable any scheduled queries that select from the authenticode table until agents are upgraded
Constrain the paths passed to the authenticode table to system-controlled directories that standard users cannot modify
Enforce application allowlisting to block execution and staging of unsigned binaries in user-writable locations

bash

# Example: disable authenticode queries in an osquery pack until agents are upgraded
# Edit the pack JSON and comment out or remove entries similar to:
# "authenticode_check": {
#   "query": "SELECT * FROM authenticode WHERE path = '/Path/To/Binary.exe';",
#   "interval": 3600
# }

# Verify the installed osquery version on Windows
osqueryi --version

# Expected output after remediation:
# osqueryi version 5.23.1