Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation. The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CrowdStrike | Falcon sensor for Windows | 8.10.0 to before 8.10.21408; 7.40.0 to before 7.40.21309; 7.39.0 to before 7.39.21113; 7.38.0 to before 7.38.21007; 7.37.0 to before 7.37.20912; 7.36.0 to before 7.36.20807; 7.35.0 to before 7.35.20712; 7.34.0 to before 7.34.20613; 7.33.0; 7.32.0 to before 7.32.20410 | 8.10.21408, 7.40.21309, 7.39.21113, 7.38.21007, 7.37.20912, 7.36.20807, 7.35.20712, 7.34.20613, 7.32.20410 | Patch available | CNA |
| CrowdStrike | Falcon sensor for Windows | 7.16.0 to before 7.16.18644 | 7.16.18644 | Patch available | CNA |
| CrowdStrike | Laroux Cleanup Tool | 1.0.20 to before 1.4.70.0 | 1.4.70.0 | Patch available | CNA |
- Falcon sensor for Windows VendorCrowdStrike Affected 8.10.0 to before 8.10.21408; 7.40.0 to before 7.40.21309; 7.39.0 to before 7.39.21113; 7.38.0 to before 7.38.21007; 7.37.0 to before 7.37.20912; 7.36.0 to before 7.36.20807; 7.35.0 to before 7.35.20712; 7.34.0 to before 7.34.20613; 7.33.0; 7.32.0 to before 7.32.20410 Fixed in 8.10.21408, 7.40.21309, 7.39.21113, 7.38.21007, 7.37.20912, 7.36.20807, 7.35.20712, 7.34.20613, 7.32.20410 Patch available CNA
- Falcon sensor for Windows VendorCrowdStrike Affected 7.16.0 to before 7.16.18644 Fixed in 7.16.18644 Patch available CNA
- Laroux Cleanup Tool VendorCrowdStrike Affected 1.0.20 to before 1.4.70.0 Fixed in 1.4.70.0 Patch available CNA
Remediation
- Fix · CNA Falcon sensor for Windows (CrowdStrike) Fixed in 8.10.21408, 7.40.21309, 7.39.21113, 7.38.21007, 7.37.20912, 7.36.20807, 7.35.20712, 7.34.20613, 7.32.20410
- Fix · CNA Falcon sensor for Windows (CrowdStrike) Fixed in 7.16.18644
- Fix · CNA Laroux Cleanup Tool (CrowdStrike) Fixed in 1.4.70.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40058
- 2026-10-03 Alias added: GHSA-437q-4cw6-qcwj
More CrowdStrike vulnerabilities
- TI-2026-28892 CrowdStrike LogScale Unauthenticated Path Traversal CVSS 3.1CRITICAL 9.8
- TI-2022-02634 CrowdStrike Falcon Uninstallation authorization CVSS 3.1LOW 2.7
- TI-2025-00971 CrowdStrike Falcon Sensor for Linux TLS Issue CVSS 3.1HIGH 8.1
- TI-2025-27746 CrowdStrike Falcon Sensor for Windows Logic Error CVSS 3.1MEDIUM 6.5
- TI-2025-27745 CrowdStrike Falcon Sensor for Windows Race Condition CVSS 3.1MEDIUM 5.6
Sources
- CVE-2026-40058 · CVE Program
- CVE-2026-40058 · NVD
- FIRST EPSS
- GHSA-437q-4cw6-qcwj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences