CVE-2020-11081mediumCWE-114

CVE-2020-11081: medium-severity vulnerability in osquery

osquery susceptible to DLL search order hijacking of zlib1.dll

Published · Updated

Follow this CVE+ Monitor osquery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected products
osquery · osquery
Related CVEs — osquery

In the same product, most dangerous first.

CVE-2020-26273MEDIUMsqlite ATTACH allows some filesystem accessEPSS 1.0%CVE-2026-54000HIGHosquery: Heap buffer overflow in `getProcessCurrentDirectory()` via `processes` table (Windows)EPSS 0.2%CVE-2026-54001HIGHosquery: Heap buffer overflow via `authenticode` table (Windows)EPSS 0.2%CVE-2026-46388MEDIUMosquery: Unprivileged users can temporarily read file carve contentsEPSS 0.1%