Researcher Claims 0-Day Privilege Escalation in CrowdStrike Falcon Sensor
A security researcher alleges a local privilege escalation vulnerability, dubbed FalconFlank, exists in CrowdStrike's Falcon Sensor, potentially allowing SYSTEM-level access.
A security researcher operating under the aliases Nightmare-Eclipse, Chaotic Eclipse, and MSNightmare has publicly detailed a claimed local privilege escalation vulnerability within the CrowdStrike Falcon Sensor. The proof-of-concept, named FalconFlank, reportedly exploits the product's remediation workflow designed to handle malicious Microsoft Office macros on Windows systems.
According to the researcher's documentation, the alleged flaw is active on devices where the "Microsoft Office file malicious macro removal" capability is enabled. The proof-of-concept is said to have been tested successfully against fully updated Windows 11 25H2 and Windows Server 2025 environments protected by CrowdStrike Falcon with its "Phase 3 Optimal Protection" settings. The public repository includes C source code, a Visual Studio solution, and compiled binaries.
While the researcher labels the issue a "Crowdstrike Falcon 0day Privilege Escalation Vulnerability," this claim has not yet been independently verified by the cybersecurity community or CrowdStrike itself. As of this report, CrowdStrike has not issued any public advisories, CVE identifiers, patch notices, or official confirmations regarding the alleged vulnerability.
The exploitation technique reportedly leverages how the security product handles Office documents flagged for malicious macros. Endpoint protection platforms often require elevated permissions for remediation tasks, such as quarantining or deleting files. The FalconFlank project suggests that the proof-of-concept might even be detected by CrowdStrike's own systems, potentially requiring exclusions or modifications to the payload for successful execution.
If validated, a privilege escalation vulnerability in a widely deployed endpoint security agent like CrowdStrike Falcon could carry significant implications. These agents typically operate with extensive system privileges to effectively monitor for and neutralize threats. An attacker gaining initial low-privileged access could potentially leverage such a flaw to elevate their standing to administrative or SYSTEM-level control, depending on the specific system configuration and the exploited remediation path.
Security teams are advised to closely monitor official CrowdStrike advisories and communications for any official statements or mitigation guidance. In the interim, administrators may consider reviewing the status of Office macro remediation policies and, where feasible, restricting local user privileges on sensitive systems.
Further technical validation from independent researchers and an official response from CrowdStrike are crucial to ascertain the scope of the alleged vulnerability, its exploitability, and the availability of any necessary patches or workarounds. The cybersecurity community awaits confirmation and details on the affected versions and impact.
This alleged discovery highlights the ongoing cat-and-mouse game between security vendors and researchers, where even the most robust security solutions can become targets for vulnerability discovery and exploitation.
The researcher, known as Chaotic Eclipse, has released a proof-of-concept (PoC) demonstrating the FalconFlank vulnerability. This PoC reportedly functions on fully updated Windows 11 and Windows Server 2025 systems when CrowdStrike Falcon is installed, though it may require exclusions or obfuscation to bypass existing detections. The researcher also noted that CrowdStrike may already have detections in place for this flaw.