Privilege Escalation Vulnerability in Falcon Crowdstrike

FalconFlank abuses the office malicious macros remediation in Crowdstrike Falcon Sensor to achieve privilege escalation in the affected system.

Affected Products

As of now the PoC works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon – Phase 3 Optimal Protection with “Microsoft Office file malicious macro removal” setting.

Recommended Actions

It is advised to disable the “Microsoft Office File Suspicious Macro Removal Windows prevention” policy setting as soon as possible.

This setting can be found in the Next-gen antivirus settings under Clean infected Microsoft Office files.

After turning off the above feature, malicious macros will no longer be replaced. Customers with prevention policy settings configured, as per best practices, will remain protected. Prevention will continue to operate as normal via the Cloud Anti-malware for Microsoft Office Files settings.

References

[1] https://github.com/MSNightmare/FalconFlank