CVE-2026-40058 CrowdStrike CVE debrief

Who should care

Defenders responsible for updating the Falcon sensor for Windows, especially for systems with the Microsoft Office File Malicious Macro Removal Windows policy setting enabled, should prioritize updating the sensor.

Why it matters

Defenders should prioritize updating the Falcon sensor for Windows to prevent potential local privilege escalation. The vulnerability exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. The CrowdStrike Laroux Malware Cleanup Tool is also affected.

• Local privilege escalation may occur if the vulnerability is exploited
• The Falcon sensor for Windows requires updating to prevent potential exploitation
• The CrowdStrike Laroux Malware Cleanup Tool is also affected and requires updating

Technical summary

The vulnerability exists in the Falcon sensor for Windows when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. This setting's impact and interaction with Cloud Anti-malware for Microsoft Office Files settings should be reviewed. An update is available for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The CrowdStrike Laroux Malware Cleanup Tool, based on the same feature in the Falcon sensor for Windows, is also affected and requires updating. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to a  

Defensive priority

Defenders should prioritize updating the Falcon sensor for Windows, especially for systems with the Microsoft Office File Malicious Macro Removal Windows policy setting enabled.

Recommended defensive actions

• Update the Falcon sensor for Windows to version 7.34 or above, 7.32 LTS, or 7.16 for Windows 7/2008 R2 systems
• Verify that the Cloud Anti-malware for Microsoft Office Files settings are enabled
• Update the CrowdStrike Laroux Malware Cleanup Tool
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the available update. The vulnerability exists in the Falcon sensor for Windows when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. The CrowdStrike Laroux Malware Cleanup Tool is also affected. The update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.