CrowdStrike Falcon Sensor/Laroux Malware Cleanup Tool prior 7.34/7.32 LTS/7.16 privileges management

Summaryinfo

A vulnerability was found in CrowdStrike Falcon Sensor and Laroux Malware Cleanup Tool. It has been classified as very critical. This affects an unknown function. The manipulation leads to privileges management. This vulnerability is listed as CVE-2026-40058. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in CrowdStrike Falcon Sensor and Laroux Malware Cleanup Tool. It has been rated as very critical. This issue affects an unknown code block. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected.  This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation. The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.

It is possible to read the advisory at crowdstrike.com. The identification of this vulnerability is CVE-2026-40058 since 04/08/2026. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/15/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 7.34, 7.32 LTS or 7.16 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Anti-Malware Software

Vendor

• CrowdStrike

Name

• Falcon Sensor
• Laroux Malware Cleanup Tool

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion