This vulnerability is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in the CrowdStrike Falcon sensor for Windows. It arises when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled, allowing an attacker with limited privileges to write arbitrary files to protected system locations. This can lead to local privilege escalation. The issue also affects the CrowdStrike Laroux Malware Cleanup Tool, which shares the same underlying feature. CrowdStrike has released security updates for affected Windows versions to remediate the vulnerability.

An unprivileged attacker can exploit this TOCTOU race condition to write arbitrary files to protected locations on the system, potentially escalating their privileges locally. This could compromise system integrity and confidentiality. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

Security updates are available immediately for affected versions of the CrowdStrike Falcon sensor for Windows and the Laroux Malware Cleanup Tool. Customers should apply these updates promptly. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled, and protection is maintained through Cloud Anti-malware for Microsoft Office Files settings. Mac, Linux, and legacy system sensors are not affected. No additional mitigation is required beyond applying the vendor-provided updates.