EUVD-2026-79123
GHSA-437q-4cw6-qcwj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (CrowdStrike) · only source for this CVE.
CVSS VectorVendor: CrowdStrike
Lifecycle Timeline
3DescriptionCVE.org
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.
An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected.
This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.
The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.
AnalysisAI
Local privilege escalation in the CrowdStrike Falcon sensor for Windows occurs when the Microsoft Office File Malicious Macro Removal policy setting is enabled, letting an unprivileged process race the sensor's macro-cleanup file operation (CWE-367) and write arbitrary files to protected locations, ultimately reaching SYSTEM-level privileges. Affected builds are the Falcon sensor for Windows at 7.34 and above, the 7.32 LTS line, and 7.16 on Windows 7/2008 R2; the CrowdStrike Laroux Malware Cleanup Tool is also affected, while Mac, Linux, and Legacy sensor platforms are not. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Crowdstrike
View allLocal privilege escalation in the Pi coding agent (npm packages @earendil-works/pi-coding-agent 0.74.0-0.78.0 and @mario
A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. Rated low severity (CVSS 2.7), this
Cleartext exposure of document passwords in the CrowdStrike OAuth API app for Splunk SOAR (versions below 5.1.3) allows
Stored XSS in the HTML session export feature of pi-coding-agent allows script execution in an exported document when a
Credential disclosure in Pi coding agent affects all versions of @mariozechner/pi-coding-agent (>=0.28.0, <=0.73.1) and
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today