CrowdStrike Falcon Windows Sensor Flaw Could Let Attackers Execute Code and Delete Files

According to CrowdStrike, two critical vulnerabilities in its Falcon Sensor for Windows could allow attackers with prior code execution to delete arbitrary files and potentially disrupt system stability. CVE-2025-42701 is a race condition (TOCTOU) with a CVSS of 5.6, while CVE-2025-42706 is a logic error affecting origin validation with a CVSS of 6.5.

The flaws could enable file deletion on affected Windows systems and potentially impact the Falcon sensor, other critical software components, or the operating system itself. CrowdStrike released patches in sensor version 7.29, with hotfixes for versions 7.24 through 7.28 and a dedicated 7.16 hotfix for Windows 7 and 2008 R2; affected versions include 7.28.20006, 7.27.19907, 7.26.19811, 7.25.19706, 7.24.19607 and earlier builds, plus 7.16.18635 and earlier 7.16 builds for older Windows environments.

The patched releases shown are 7.28.20008 and later, 7.27.19909, 7.26.19813, 7.25.19707, 7.24.19608, and 7.16.18637 for legacy systems, and CrowdStrike also provides a GitHub query to identify potentially impacted hosts. No evidence of active exploitation in production environments has been reported, and CrowdStrike notes no expected performance impact from the updates, urging customers to upgrade affected Windows hosts promptly.