Vulnerability-Lookup

CVE-2025-42701 (GCVE-0-2025-42701)

Vulnerability from cvelistv5 – Published: 2025-10-08 17:18 – Updated: 2025-10-08 19:26

Title

CrowdStrike Falcon Sensor for Windows Race Condition

Summary

A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.

Severity

5.6 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-08 17:44 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

CrowdStrike CNA under the mitre root

CNA scorecard – unranked: 2 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://www.crowdstrike.com/en-us/security-adviso…

Impacted products

2 products

Vendor	Product	Version	CPE status
CrowdStrike	Falcon sensor for Windows	Affected: 7.28 , < 7.28.20008 (semver) Affected: 7.27 , < 7.27.19909 (semver) Affected: 7.26 , < 7.26.19813 (semver) Affected: 7.25 , < 7.25.19707 (semver) Affected: 7.24 , < 7.24.19608 (semver)	guessed
CrowdStrike	Falcon sensor for Windows	Affected: 7.16 , < 7.16.18637 (semver)	guessed

Date Public

2025-10-08 17:17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-42701",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T17:44:45.496342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-08T19:26:49.280Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows"
          ],
          "product": "Falcon sensor for Windows",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "lessThan": "7.28.20008",
              "status": "affected",
              "version": "7.28",
              "versionType": "semver"
            },
            {
              "lessThan": "7.27.19909",
              "status": "affected",
              "version": "7.27",
              "versionType": "semver"
            },
            {
              "lessThan": "7.26.19813",
              "status": "affected",
              "version": "7.26",
              "versionType": "semver"
            },
            {
              "lessThan": "7.25.19707",
              "status": "affected",
              "version": "7.25",
              "versionType": "semver"
            },
            {
              "lessThan": "7.24.19608",
              "status": "affected",
              "version": "7.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows 7",
            "Windows Server 2008"
          ],
          "product": "Falcon sensor for Windows",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "lessThan": "7.16.18637",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2025-10-08T17:17:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eA race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cb\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cb\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\n\n\nThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \n\n\nThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\n\nCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-08T17:31:02.619Z",
        "orgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "shortName": "CrowdStrike"
      },
      "references": [
        {
          "url": "https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CrowdStrike Falcon Sensor for Windows Race Condition",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
    "assignerShortName": "CrowdStrike",
    "cveId": "CVE-2025-42701",
    "datePublished": "2025-10-08T17:18:32.434Z",
    "dateReserved": "2025-04-16T13:03:27.473Z",
    "dateUpdated": "2025-10-08T19:26:49.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-42701",
      "date": "2026-10-10",
      "epss": "0.00122",
      "percentile": "0.01792"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "platforms": [
                  "Windows"
                ],
                "product": "Falcon sensor for Windows",
                "vendor": "CrowdStrike",
                "versions": [
                  {
                    "lessThan": "7.28.20008",
                    "status": "affected",
                    "version": "7.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.27.19909",
                    "status": "affected",
                    "version": "7.27",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.26.19813",
                    "status": "affected",
                    "version": "7.26",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.25.19707",
                    "status": "affected",
                    "version": "7.25",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "7.24.19608",
                    "status": "affected",
                    "version": "7.24",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "platforms": [
                  "Windows 7",
                  "Windows Server 2008"
                ],
                "product": "Falcon sensor for Windows",
                "vendor": "CrowdStrike",
                "versions": [
                  {
                    "lessThan": "7.16.18637",
                    "status": "affected",
                    "version": "7.16",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\n\n\nThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \n\n\nThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\n\nCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed."
          },
          {
            "lang": "es",
            "value": "Una condici\u00f3n de carrera existe en el sensor Falcon para Windows que podr\u00eda permitir a un atacante, con la capacidad previa de ejecutar c\u00f3digo en un host, eliminar archivos arbitrarios. CrowdStrike lanz\u00f3 una correcci\u00f3n de seguridad para este problema en las versiones 7.24 y superiores del sensor Falcon para Windows y en todos los sensores de Visibilidad a Largo Plazo (LTV).\n\nNo hay indicios de explotaci\u00f3n de estos problemas en la naturaleza. Nuestro equipo de b\u00fasqueda de amenazas e inteligencia est\u00e1 monitoreando activamente la explotaci\u00f3n y mantenemos visibilidad sobre cualquier intento de este tipo.\n\nEl sensor Falcon para Mac, el sensor Falcon para Linux y el sensor Falcon para Sistemas Heredados no se ven afectados por esto.\n\nCrowdStrike fue informado de este problema a trav\u00e9s de nuestro programa de recompensas por errores de HackerOne. Fue descubierto por Cong Cheng y divulgado de manera responsable."
          }
        ],
        "id": "CVE-2025-42701",
        "lastModified": "2026-10-08T13:10:00.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.1,
              "impactScore": 4.0,
              "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-42701",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-08T17:44:45.496342Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-08T18:15:34.520",
        "references": [
          {
            "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
            "url": "https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/"
          }
        ],
        "sourceIdentifier": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-367"
              }
            ],
            "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-10-10T01:31:58+00:00",
      "cve": "CVE-2025-42701",
      "id": "CVE-2025-42701",
      "initial_release_date": "2025-10-08T17:17:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CrowdStrike Falcon Sensor for Windows Race Condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-42701.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-42701",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-08T17:44:45.496342Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-08T17:44:47.947Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "platforms": [
                "Windows"
              ],
              "product": "Falcon sensor for Windows",
              "vendor": "CrowdStrike",
              "versions": [
                {
                  "lessThan": "7.28.20008",
                  "status": "affected",
                  "version": "7.28",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.27.19909",
                  "status": "affected",
                  "version": "7.27",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.26.19813",
                  "status": "affected",
                  "version": "7.26",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.25.19707",
                  "status": "affected",
                  "version": "7.25",
                  "versionType": "semver"
                },
                {
                  "lessThan": "7.24.19608",
                  "status": "affected",
                  "version": "7.24",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unknown",
              "platforms": [
                "Windows 7",
                "Windows Server 2008"
              ],
              "product": "Falcon sensor for Windows",
              "vendor": "CrowdStrike",
              "versions": [
                {
                  "lessThan": "7.16.18637",
                  "status": "affected",
                  "version": "7.16",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "datePublic": "2025-10-08T17:17:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eA race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cb\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cb\u003e\u003c/b\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: transparent;\"\u003eCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.\u003c/span\u003e\u003c/p\u003e"
                }
              ],
              "value": "A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\n\n\nThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \n\n\nThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\n\nCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-27",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-08T17:31:02.619Z",
            "orgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
            "shortName": "CrowdStrike"
          },
          "references": [
            {
              "url": "https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "CrowdStrike Falcon Sensor for Windows Race Condition",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "assignerShortName": "CrowdStrike",
        "cveId": "CVE-2025-42701",
        "datePublished": "2025-10-08T17:18:32.434Z",
        "dateReserved": "2025-04-16T13:03:27.473Z",
        "dateUpdated": "2025-10-08T19:26:49.280Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-42701

Vulnerability from fkie_nvd - Published: 2025-10-08 18:15 - Updated: 2026-10-08 13:10

Severity

5.6 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	13ddcd98-6f4a-40a8-8e24-29ca0aee4661	https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows"
          ],
          "product": "Falcon sensor for Windows",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "lessThan": "7.28.20008",
              "status": "affected",
              "version": "7.28",
              "versionType": "semver"
            },
            {
              "lessThan": "7.27.19909",
              "status": "affected",
              "version": "7.27",
              "versionType": "semver"
            },
            {
              "lessThan": "7.26.19813",
              "status": "affected",
              "version": "7.26",
              "versionType": "semver"
            },
            {
              "lessThan": "7.25.19707",
              "status": "affected",
              "version": "7.25",
              "versionType": "semver"
            },
            {
              "lessThan": "7.24.19608",
              "status": "affected",
              "version": "7.24",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Windows 7",
            "Windows Server 2008"
          ],
          "product": "Falcon sensor for Windows",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "lessThan": "7.16.18637",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\n\n\nThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \n\n\nThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\n\nCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed."
    },
    {
      "lang": "es",
      "value": "Una condici\u00f3n de carrera existe en el sensor Falcon para Windows que podr\u00eda permitir a un atacante, con la capacidad previa de ejecutar c\u00f3digo en un host, eliminar archivos arbitrarios. CrowdStrike lanz\u00f3 una correcci\u00f3n de seguridad para este problema en las versiones 7.24 y superiores del sensor Falcon para Windows y en todos los sensores de Visibilidad a Largo Plazo (LTV).\n\nNo hay indicios de explotaci\u00f3n de estos problemas en la naturaleza. Nuestro equipo de b\u00fasqueda de amenazas e inteligencia est\u00e1 monitoreando activamente la explotaci\u00f3n y mantenemos visibilidad sobre cualquier intento de este tipo.\n\nEl sensor Falcon para Mac, el sensor Falcon para Linux y el sensor Falcon para Sistemas Heredados no se ven afectados por esto.\n\nCrowdStrike fue informado de este problema a trav\u00e9s de nuestro programa de recompensas por errores de HackerOne. Fue descubierto por Cong Cheng y divulgado de manera responsable."
    }
  ],
  "id": "CVE-2025-42701",
  "lastModified": "2026-10-08T13:10:00.200",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 4.0,
        "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-42701",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-08T17:44:45.496342Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-08T18:15:34.520",
  "references": [
    {
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
      "url": "https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/"
    }
  ],
  "sourceIdentifier": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
      "type": "Secondary"
    }
  ]
}

GHSA-RXJ5-2XG2-3QMW

Vulnerability from github – Published: 2025-10-08 18:30 – Updated: 2025-10-08 18:30

Details

There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts.

The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.

CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.

Severity

5.6 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-42701"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-08T18:15:34Z",
    "severity": "MODERATE"
  },
  "details": "A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors.\n\n\nThere is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. \n\n\nThe Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this.\n\nCrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.",
  "id": "GHSA-rxj5-2xg2-3qmw",
  "modified": "2025-10-08T18:30:16Z",
  "published": "2025-10-08T18:30:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42701"
    },
    {
      "type": "WEB",
      "url": "https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-42701 (GCVE-0-2025-42701)

FKIE_CVE-2025-42701

GHSA-RXJ5-2XG2-3QMW

Tags

Sightings

Nomenclature

Related by attack behaviour