CVE-2025-42701
BaseFortify
Publication date: 2025-10-08
Last updated on: 2025-10-08
Assigner: CrowdStrike Holdings, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| crowdstrike | falcon_sensor_for_windows | 7.28 |
| crowdstrike | falcon_sensor_for_windows | 7.24 |
| crowdstrike | falcon_sensor_for_windows | 7.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-367 | The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition in the CrowdStrike Falcon sensor for Windows that allows an attacker who already has the ability to execute code on the host to delete arbitrary files. It is caused by a logic error and affects specific versions of the Falcon sensor for Windows. The flaw could disrupt the sensor's operation or other software on the system. It does not affect Falcon sensors for Mac, Linux, or Legacy Windows systems. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with prior code execution access to delete arbitrary files on the affected system. This could lead to stability or functionality issues with the Falcon sensor itself or other software, including the operating system, potentially causing system disruption or failure. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves identifying if vulnerable versions of the Falcon sensor for Windows are installed on hosts. CrowdStrike recommends upgrading to fixed sensor versions and provides additional resources and queries for impacted hosts via their GitHub and customer support channels. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Falcon sensor for Windows to the fixed versions starting from 7.24.19608 and above (including all Long Term Visibility sensors). This update addresses the race condition vulnerability and prevents exploitation. Monitoring for any suspicious activity is also advised. [1]