TI-2018-04661 Aliases CVE-2018-6336 GHSA-4xm5-4w7j-j8qm

An issue was discovered in osquery.

LOW 37CWE-254Published 2018-12-31 · Updated 2025-05-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00486 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed osquery (Facebook): 3.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	osquery	3.2.7; before 3.2.7	3.2.7	Patch available	CNA

osquery VendorMeta Affected 3.2.7; before 3.2.7 Fixed in 3.2.7 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:osquery::::::::	before 3.2.7	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:osquery:*:*:*:*:*:*:*:* Versions before 3.2.7 Vulnerable ·backstage

Remediation

Fix · CNA osquery (Facebook) Fixed in 3.2.7

Timeline

2026-10-02 Threatist record created from CVE-2018-6336
2026-10-03 Alias added: GHSA-4xm5-4w7j-j8qm

References

Exploit 1

https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences