CVE-2026-40058

A time-of-check/time-of-use race condition (CWE-367) in the CrowdStrike Falcon sensor for Windows allows an unprivileged local user to write arbitrary files to protected locations, which can be leveraged for local privilege escalation with high impact to confidentiality, integrity, and availability (CVSS 8.8). The flaw only manifests when the optional 'Microsoft Office File Malicious Macro Removal' Windows policy setting is enabled; Cloud Anti-malware for Microsoft Office Files continues to provide protection and is unaffected. The standalone CrowdStrike Laroux Malware Cleanup Tool, built on the same code, is also vulnerable. Affected customers are those running Falcon sensor for Windows (Mac, Linux, and Legacy System sensors are not affected) with the macro-removal policy enabled. No public proof of concept exists, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update the Falcon sensor for Windows immediately to the latest build in your supported line (7.34 and above, 7.32 LTS, or 7.16 for Windows 7/2008 R2) and update the Laroux Malware Cleanup Tool if it has been used in your environment. Review your sensor policy configuration to determine whether the Microsoft Office File Malicious Macro Removal setting is enabled, and confirm that Cloud Anti-malware for Microsoft Office Files remains enabled as compensating protection. Monitor endpoints for anomalous writes to protected directories or unexplained privilege escalation from low-privilege accounts.