CrowdStrike Falcon CVE-2025-42701

Exploitation requires the attacker to ALREADY have the ability to execute code on the target Windows host (a post-compromise prerequisite, PR:L / AV:L), and to successfully win a time-of-check/time-of-use race condition (CWE-367) in the Falcon sensor's file-handling path, which the vendor-assigned AC:H reflects as timing-dependent and not reliably triggerable on demand. It affects only the Falcon sensor for Windows at versions below 7.24; the Mac, Linux, and Legacy Systems sensors are explicitly not impacted, and LTV sensors received the fix. Limiting factors: no remote vector (local only), no network exposure, no path to confidentiality or integrity compromise, and success hinges on repeatedly hitting a narrow race window - all of which sharply constrain realistic exploitation beyond an already-present adversary.

This is a genuine but comparatively low-priority issue once all signals are weighed together. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H, base 5.6 MEDIUM) describes a local, high-complexity attack that requires the adversary to already possess low-privilege code execution on the host; the only impact is high availability (arbitrary file deletion), with no confidentiality or integrity loss. These signals are mutually consistent: a TOCTOU race (CWE-367) naturally maps to AC:H, and the stated prerequisite of 'prior ability to execute code on a host' matches AV:L/PR:L. The EPSS score of 0.12% (2nd percentile) reinforces a low likelihood of near-term broad exploitation, there is no CISA KEV listing, and no public exploit code was provided in the input. The vendor explicitly states no observed in-the-wild exploitation. No SSVC decision data was supplied. The primary risk is as a post-compromise escalation/sabotage primitive - an attacker who already has a foothold could abuse the privileged sensor to delete protected files (potentially tampering with the EDR itself or other security-relevant files, consistent with the Scope-change flag). This is NOT a high-real-risk internet-facing issue despite running inside a security product; treat it as a defense-in-depth hardening fix rather than an emergency. Note one data gap: no independent third-party confirmation of fixed versions beyond the vendor advisory, and the only reference is the CrowdStrike advisory itself.

An attacker who has already gained low-privilege code execution on a Windows endpoint (e.g., via a separate initial-access vulnerability or malware) races the Falcon sensor's file-handling logic to make the privileged sensor delete files the attacker could not otherwise remove. By repeatedly triggering the time-of-check/time-of-use window, the attacker could delete protected or security-relevant files to disrupt defenses or destroy data. No public proof-of-concept was identified in the provided data, and the race condition's high complexity makes reliable exploitation non-trivial.