CVE-2026-40058

Name of the Vulnerable Software and Affected Versions Falcon sensor for Windows versions prior to 8.10.21408 Falcon sensor for Windows versions prior to 7.40.21309 Falcon sensor for Windows versions prior to 7.39.21113 Falcon sensor for Windows versions prior to 7.38.21007 LTS Falcon sensor for Windows versions prior to 7.37.20912 Falcon sensor for Windows versions prior to 7.36.20807 Falcon sensor for Windows versions prior to 7.35.20712 Falcon sensor for Windows versions prior to 7.34.20613 Falcon sensor for Windows versions prior to 7.32.20410 LTS Falcon sensor for Windows versions prior to 7.16.18644 CrowdStrike Laroux Malware Cleanup Tool versions prior to 1.4.70.0

Description A Time-of-check Time-of-use (TOCTOU) race condition exists in the Falcon sensor for Windows. TOCTOU is a software problem where a program checks the state of a resource and then acts on that resource, but the state changes between the check and the action. This issue occurs when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. An unprivileged local user can exploit this to write an arbitrary file to protected locations while the sensor is cleaning malicious Microsoft Office files, potentially leading to local privilege escalation to SYSTEM level.

Recommendations Update Falcon sensor for Windows to version 8.10.21408 or later. Update Falcon sensor for Windows to version 7.40.21309 or later. Update Falcon sensor for Windows to version 7.39.21113 or later. Update Falcon sensor for Windows to version 7.38.21007 LTS or later. Update Falcon sensor for Windows to version 7.37.20912 or later. Update Falcon sensor for Windows to version 7.36.20807 or later. Update Falcon sensor for Windows to version 7.35.20712 or later. Update Falcon sensor for Windows to version 7.34.20613 or later. Update Falcon sensor for Windows to version 7.32.20410 LTS or later. Update Falcon sensor for Windows to version 7.16.18644 or later. Update CrowdStrike Laroux Malware Cleanup Tool to version 1.4.70.0 or later. As a temporary mitigation, disable the Microsoft Office File Malicious Macro Removal control in Windows prevention policies.