CVE-2026-40058

Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows

HIGH

8.8

CVSS Score

Published: September 15, 2026 at 05:47 PM UTC

Updated: September 18, 2026 at 07:49 PM UTC

3 products affected across 1 vendorFalconFalcon SensorLaroux Cleanup Tool

Using Falcon sensor for Windows by CrowdStrike?

Get instant alerts when new vulnerabilities affect Falcon sensor for Windows - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 0.1%

SSVC

No known exploit

Description

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation. The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Falcon · Crowdstrike

95%

v ≥ 7.33.07.16.0 ≤ v < 7.16.186447.32.0 ≤ v < 7.32.204107.34.0 ≤ v < 7.34.206137.35.0 ≤ v < 7.35.207127.36.0 ≤ v < 7.36.208077.37.0 ≤ v < 7.37.209127.38.0 ≤ v < 7.38.210077.39.0 ≤ v < 7.39.211137.40.0 ≤ v < 7.40.213098.10.0 ≤ v < 8.10.214087.16 7.32 7.33 7.34 7.35 7.36 7.37 7.38 7.39 7.40 8.10

Affected range stops below 7.16.18644, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.32.20410, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.34.20613, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.35.20712, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.36.20807, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.37.20912, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.38.21007, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.39.21113, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.40.21309, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.10.21408, so it looks safe — our inference, not a vendor statement

Falcon Sensor · Crowdstrike

60%

7.16.0 ≤ v < 7.16.186447.32.0 ≤ v < 7.32.204107.34.0 ≤ v < 7.34.206137.35.0 ≤ v < 7.35.207127.36.0 ≤ v < 7.36.208077.37.0 ≤ v < 7.37.209127.38.0 ≤ v < 7.38.210077.39.0 ≤ v < 7.39.211137.40.0 ≤ v < 7.40.213098.10.0 ≤ v < 8.10.214087.16.0 7.32.0 7.33.0 7.34.0 7.35.0 7.36.0 7.37.0 7.38.0 7.39.0 7.40.0 8.10.0