Critical CrowdStrike Falcon Vulnerability Lets Attackers Escalate Privileges

Key Takeaways

• A security researcher has publicly released proof-of-concept code for an alleged local privilege escalation vulnerability in CrowdStrike Falcon Sensor.
• The flaw reportedly impacts Windows systems where CrowdStrike’s “Microsoft Office file malicious macro removal” capability is active.
• Successful exploitation could allow a low-privileged local attacker to gain elevated system access.
• CrowdStrike has not yet publicly confirmed the vulnerability, issued a CVE, or provided official guidance.

Researcher Alleges Critical CrowdStrike Falcon Privilege Escalation Vulnerability

A cybersecurity researcher, identified as Nightmare-Eclipse (also known as Chaotic Eclipse and MSNightmare), has unveiled a project claiming to exploit a critical security flaw within the CrowdStrike Falcon Sensor. This alleged vulnerability could enable local privilege escalation, potentially granting unauthorized users significantly higher access rights on affected systems.

The project, dubbed FalconFlank, posits that the issue leverages CrowdStrike’s remediation mechanisms designed to handle malicious Microsoft Office macros on Windows platforms.

According to the project’s repository, the purported flaw specifically impacts devices where the “Microsoft Office file malicious macro removal” feature is enabled within the CrowdStrike Falcon configuration.

The researcher asserted that the proof-of-concept (PoC) successfully demonstrated exploitation against fully updated Windows 11 25H2 and Windows Server 2025 environments, both protected by CrowdStrike Falcon with Phase 3 Optimal Protection activated.

The public repository, created recently, contains C source code, a Visual Studio solution, project files, headers, and a compiled x64 release directory for the PoC.

CrowdStrike Falcon 0-Day Privilege Escalation Claim

The FalconFlank README describes the project as a “Crowdstrike Falcon 0day Privilege Escalation Vulnerability.” However, this claim has not undergone independent verification by third-party security experts or CrowdStrike itself.

As of this report, CrowdStrike has not issued any public advisory, assigned a CVE identifier, released a patch notice, or provided official confirmation regarding the alleged vulnerability. The researcher’s claim centers on the security product’s handling of Office documents flagged for containing malicious macros.

In the realm of endpoint protection platforms, remediation features frequently operate with elevated permissions. This is necessary to perform critical actions such as quarantining, deleting, modifying, or restoring files within protected system locations.

A local attacker could potentially achieve higher privileges by manipulating such a remediation process to load an attacker-controlled file, follow a malicious execution path, or improperly handle unsafe file metadata. The FalconFlank README suggests that CrowdStrike detections might already identify the released proof-of-concept code.

The repository also indicates that testing the PoC might necessitate Falcon exclusions or modifications to the payload’s DLL loading method. These statements originate solely from the researcher and should be interpreted with caution, as they do not definitively establish the existence of a vulnerability or guarantee reliable exploitation across diverse customer environments.

If validated, a privilege escalation flaw within an endpoint security agent like Falcon could carry significant security implications. Falcon operates with extensive operating system privileges to effectively monitor system activity and prevent threats.

An attacker who has already gained access to a low-privileged Windows account could potentially leverage such a local escalation vulnerability to obtain administrative or even SYSTEM-level access, depending on the specific remediation path exploited and the system’s configuration.

What You Should Do

• Monitor CrowdStrike’s official security advisories, support communications, and Falcon console notifications for any official confirmation or mitigation guidance.
• Review whether Office macro remediation policies are enabled within your CrowdStrike Falcon configuration.
• Where feasible, implement measures to limit local user access and adhere to the principle of least privilege.
• Await further technical validation and an official response from CrowdStrike to determine affected versions, precise exploitation requirements, and recommended remediation steps.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.