CVE-2026-40058: CrowdStrike Falcon Privilege Escalation

CVE-2026-40058 Overview

CVE-2026-40058 is a local privilege escalation vulnerability in the CrowdStrike Falcon sensor for Windows. The flaw is a time-of-check to time-of-use (TOCTOU) race condition [CWE-367] tied to the Microsoft Office File Malicious Macro Removal Windows policy. When that policy is enabled, an unprivileged local user can achieve an arbitrary file write to protected locations, enabling escalation to SYSTEM.

The CrowdStrike Laroux Malware Cleanup Tool shares the same code path and is also affected. Falcon sensors for Mac, Linux, and Legacy Systems are not impacted.

Critical Impact
A local, low-privileged attacker can write arbitrary files to protected paths on Windows endpoints running affected Falcon sensor versions, resulting in local privilege escalation to SYSTEM.

Affected Products

CrowdStrike Falcon sensor for Windows versions below 7.34
CrowdStrike Falcon sensor for Windows 7.32 LTS (pre-fix build)
CrowdStrike Falcon sensor for Windows 7.16 for Windows 7 and Server 2008 R2
CrowdStrike Laroux Malware Cleanup Tool

Discovery Timeline

2026-09-15 - CVE-2026-40058 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-40058

Vulnerability Analysis

The vulnerability is a TOCTOU race condition in the Falcon sensor's Microsoft Office File Malicious Macro Removal feature on Windows. When the policy is enabled, the sensor validates and then modifies files as part of macro removal. A local attacker can manipulate file system state between the validation step and the write step, redirecting the privileged write operation to an attacker-chosen location.

Because the sensor runs with elevated privileges, the redirected write inherits those privileges. This lets an unprivileged process place or overwrite files in locations normally reserved for SYSTEM, such as service binaries, DLL search paths, or scheduled task definitions. The result is local privilege escalation on the affected host.

Customers using the Cloud Anti-malware for Microsoft Office Files setting instead of the local policy are not exposed, because that path performs the analysis in the cloud rather than through the vulnerable local code path.

Root Cause

The root cause is improper synchronization between file validation and file modification in the macro removal routine [CWE-367]. The sensor checks the file's identity or path, then performs a write based on that earlier check without re-validating that the target has not changed. Symlinks, junctions, or hardlinks planted by the attacker between the two operations cause the privileged write to land on an attacker-controlled target.

Attack Vector

Exploitation requires local access and low privileges on a Windows endpoint with the vulnerable policy enabled. The attacker stages a crafted Office file, triggers the macro removal action, and races the sensor to swap the target path before the write completes. See the CrowdStrike Security Advisory CVE-2026-40058 for vendor-supplied technical details. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-40058

Indicators of Compromise

Unexpected file writes to protected locations such as C:\Windows\System32, service binary paths, or C:\Program Files originating from processes spawned by low-privileged user sessions.
Creation of symbolic links, junctions, or hardlinks in user-writable directories immediately before Falcon macro removal activity.
New or modified DLLs and executables in application directories that were not deployed through normal software distribution channels.

Detection Strategies

Audit Windows Security event logs for object access on protected directories, correlating writes with the parent process token and integrity level.
Monitor for MiniFilter and reparse point creation events (Sysmon event ID 1 and 11) originating from unprivileged user contexts.
Alert on new services, scheduled tasks, or auto-start entries that reference binaries written to unusual paths shortly after Office file interaction.

Monitoring Recommendations

Track the deployed Falcon sensor version fleet-wide and flag hosts running versions below 7.34, 7.32 LTS fixed build, or 7.16 fixed build.
Review policy configuration to identify endpoints where the Microsoft Office File Malicious Macro Removal Windows setting is enabled.
Monitor for privilege escalation behaviors such as SYSTEM-context processes spawned from user-owned binaries following macro removal events.

How to Mitigate CVE-2026-40058

Immediate Actions Required

Upgrade the CrowdStrike Falcon sensor for Windows to the fixed release for the appropriate channel: 7.34 or above, 7.32 LTS fixed build, or 7.16 for Windows 7 and Server 2008 R2.
Update the CrowdStrike Laroux Malware Cleanup Tool to the current version released alongside the sensor fix.
Inventory endpoints with the Microsoft Office File Malicious Macro Removal Windows policy enabled and prioritize them for patching.

Patch Information

CrowdStrike has released fixed builds for Falcon sensor for Windows 7.34 and above, 7.32 LTS, and 7.16 for legacy Windows 7 and Server 2008 R2 systems. A corresponding update for the CrowdStrike Laroux Malware Cleanup Tool is available. Refer to the CrowdStrike Security Advisory CVE-2026-40058 for exact build numbers and download instructions.

Workarounds

Disable the Microsoft Office File Malicious Macro Removal Windows policy until the sensor is upgraded, since the vulnerability only exists when this setting is enabled.
Rely on the Cloud Anti-malware for Microsoft Office Files setting, which is not affected by this vulnerability and provides equivalent protection.
Restrict interactive local logon on high-value Windows hosts to reduce the pool of accounts able to stage a local exploitation attempt.

bash

# Verify installed Falcon sensor version on Windows
sc query csagent
"C:\Program Files\CrowdStrike\CSFalconService.exe" --version

# PowerShell: enumerate hosts below fixed build
Get-CimInstance Win32_Product | Where-Object { $_.Name -like 'CrowdStrike*' } | Select-Object Name, Version