Researcher Publishes PoC for Reported CrowdStrike Falcon Privilege Escalation Flaw

A security researcher known for publishing Microsoft zero-day vulnerabilities has released proof-of-concept code for a reported privilege escalation issue affecting a Microsoft Office protection feature in CrowdStrike Falcon on Windows.

The researcher, who uses several online aliases including Nightmare Eclipse, calls the issue “FalconFlank.” According to the published advisory, the vulnerability involves Falcon’s suspicious macro removal capability, which examines Office files and removes macros considered potentially harmful. The researcher said the flaw could allow a local attacker to gain elevated privileges under certain configurations.

CrowdStrike said it was investigating the claims. The company advised customers to disable the Windows policy setting for Microsoft Office File Suspicious Macro Removal while its review continues. It added that customers can continue to use its cloud anti-malware protections for Microsoft Office files and directed administrators to a technical alert in the Falcon support portal.

The published material claims the issue affects fully updated Windows 11 and Windows Server installations running Falcon with higher protection settings and the macro-removal feature enabled. Independent security researcher Kevin Beaumont said he had validated that the proof of concept worked, though organizations should rely on vendor guidance and internal testing when assessing exposure.

Broader endpoint security scrutiny

FalconFlank is part of a recent series of vulnerability disclosures from the same researcher involving endpoint protection and antivirus products. Other claimed issues include local privilege escalation flaws affecting Kaspersky endpoint software and Avast products from Gen Digital. Gen Digital said it was aware of a vulnerability affecting a subset of its products and was working on a patch.

The disclosures underscore a recurring concern in endpoint security: products designed to run with extensive system privileges can become attractive targets when their drivers, sandboxing features, or remediation mechanisms contain flaws.

Recommended actions

• Review CrowdStrike’s latest support guidance and technical alert.
• Disable the affected macro-removal policy if advised by CrowdStrike.
• Maintain endpoint agent, operating system, and Office updates.
• Monitor vendor notices for patches, detections, and configuration changes.
• Restrict local administrative access and investigate unexpected privilege changes.

As of publication, CrowdStrike had not publicly detailed a permanent fix. Organizations should treat publicly released exploit claims as a prompt to validate configurations and apply vendor mitigations promptly.