CrowdStrike Falcon Sensor TOCTOU Race Condition Local Privilege Escalation (CVE-2026-40058)

CVE-2026-40058 Vulnerability Key Information Summary Vulnerability Overview Vulnerability ID: CVE-2026-40058 Affected Component: CrowdStrike Falcon Sensor for Windows Trigger Condition: Only present when the "Microsoft Office File Malicious Macro Removal" Windows policy setting is enabled Vulnerability Type: TOCTOU race condition (CWE-367 / CAPEC-27, exploiting the race condition via symbolic links) Impact: Enables arbitrary file writes to protected locations in a non-privileged context, potentially leading to local privilege escalation Severity Level: 8.8 (HIGH) Exploitation Status: No evidence of in-the-wild exploitation Scope of Impact Affected Windows sensor versions (when macro removal policy is enabled): - 8.10.21405 and later (fixed in build 8.10.21408 and later) - 7.40.21306 (fixed in build 7.40.21309) - 7.39.21108 / 7.39.21105 (fixed in build 7.39.21113) - 7.38.21003 LTS (fixed in build 7.38.21007 LTS and later) - 7.37.20907 (fixed in build 7.37.20912) - 7.36.20805 (fixed in build 7.36.20807) - 7.35.20709 (fixed in build 7.35.20712) - 7.34.20610 (fixed in build 7.34.20613) - 7.32.20406 LTS MR2 / 7.32.20405 LTS MR1 (fixed in build 7.32.20410 LTS) - 7.32.20403 LTS - 7.16.18642 / 7.16.18637 / 7.16.18635 / 7.16.18632 (Windows 7/2008 R2 only, fixed in build 7.16.18644) End-of-support versions: 7.33, 7.31, and earlier (must upgrade to a supported fixed version) CrowdStrike Laroux Malware Cleanup Tool: Version 1.3.65.0 and earlier are affected; should be replaced with 1.4.70.0 Not affected: Falcon sensors for Mac, Linux, and Legacy Systems Remediation Upgrade affected Windows hosts to the fixed sensor versions If the "Microsoft Office File Malicious Macro Removal" policy was previously disabled as a temporary mitigation, it should be re-enabled after the fix is applied Upgrade Laroux Malware Cleanup Tool to 1.4.70.0 POC / Exploit Code The page does not include** a POC or exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

CrowdStrike Falcon Sensor TOCTOU Race Condition Local Privilege Escalation (CVE-2026-40058)