CVE-2024-54131

The Kolide Agent (aka: Launcher) is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent (known as `launcher`) allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started storing upgraded binaries in the ProgramData directory. This move to the new directory meant the launcher root directory inherited default permissions that are not as strict as the previous location. These incorrect default permissions in conjunction with an omitted SystemDrive environmental variable (when launcher starts osqueryd), allows a malicious actor with access to the local Windows device to successfully place an arbitrary DLL into the osqueryd process's search path. Under some circumstances, this DLL will be executed when osqueryd performs a WMI query. This combination of events could then allow the attacker to escalate their privileges to SYSTEM. Impacted versions include versions >= 1.5.3 and the fix has been released in 1.12.3.

• CWE-276
• CWE-456

• https://github.com/kolide/launcher/pull/1510
• https://github.com/kolide/launcher/security/advisories/GHSA-66q9-2rvx-qfj5

Published

Dec 3, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-54126This vulnerability exists in the TP-Link Archer C50 due to i…8.5
• CVE-2024-54127This vulnerability exists in the TP-Link Archer C50 due to p…4.3
• CVE-2024-54128Directus is a real-time API and App dashboard for managing S…4.6
• CVE-2024-54129The NASA’s Interplanetary Overlay Network (ION) is an implem…9.2
• CVE-2024-5413A vulnerability have been discovered in PhpMyBackupPro affec…6.1
• CVE-2024-54130The NASA’s Interplanetary Overlay Network (ION) is an implem…9.2
• CVE-2024-54132The GitHub CLI is GitHub’s official command line tool. A sec…6.3
• CVE-2024-54133Action Pack is a framework for handling and responding to we…2.3
• CVE-2024-54134A publish-access account was compromised for `@solana/web3.j…8.3
• CVE-2024-54135ClipBucket V5 provides open source video hosting with PHP. C…8.8
• CVE-2024-54136ClipBucket V5 provides open source video hosting with PHP. C…9.8
• CVE-2024-54137liboqs is a C-language cryptographic library that provides i…7.5