CVE-2025-42701
CrowdStrike Falcon Sensor for Windows Race Condition
Description
A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.
INFO
Published Date :
Oct. 8, 2025, 6:15 p.m.
Last Modified :
Oct. 8, 2025, 7:38 p.m.
Remotely Exploit :
No
Source :
13ddcd98-6f4a-40a8-8e24-29ca0aee4661
Affected Products
The following products are affected by CVE-2025-42701
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 13ddcd98-6f4a-40a8-8e24-29ca0aee4661 |
Solution
- Update Falcon sensor to version 7.24 or later.
- Ensure all LTS sensors are updated.
- Monitor for exploitation activity.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-42701.
| URL | Resource |
|---|---|
| https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/ |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-42701 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-42701
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-42701 vulnerability anywhere in the article.
-
CybersecurityNews
CrowdStrike Falcon Windows Sensor Vulnerability Enables Code Execution and File Deletion
CrowdStrike has disclosed and released patches for two medium-severity vulnerabilities in its Falcon sensor for Windows that could allow an attacker to delete arbitrary files. The security vulnerabili ... Read more
-
Daily CyberSecurity
CrowdStrike Releases Fixes for Two Falcon Sensor for Windows Vulnerabilities (CVE-2025-42701 & CVE-2025-42706)
CrowdStrike has released security updates to address two vulnerabilities in its Falcon Sensor for Windows, identified as CVE-2025-42701 and CVE-2025-42706. While both flaws require prior local code ex ... Read more
-
Daily CyberSecurity
High-Severity Deno Flaw CVE-2025-61787 Allows Command Injection on Windows
The Deno project has issued a new security advisory warning of a command injection vulnerability on Windows systems, tracked as CVE-2025-61787 and rated CVSS 8.1 (High). The flaw affects Deno versions ... Read more
-
Daily CyberSecurity
Microsoft Warns: Threat Actors Turn Microsoft Teams into a Weapon for Ransomware, Espionage, and Social Engineering
Microsoft Threat Intelligence has released an extensive report detailing how both cybercriminals and state-sponsored actors are weaponizing Microsoft Teams, exploiting its collaboration features — mes ... Read more
-
Daily CyberSecurity
Critical Akka.NET Flaw CVE-2025-61778 (CVSS 9.3) Allows Untrusted Nodes to Join Secure Clusters
The Akka.NET team has issued a critical security advisory for a severe vulnerability in its Akka.Remote module that could allow untrusted systems to join or communicate with trusted clusters without p ... Read more
The following table lists the changes that have been made to the
CVE-2025-42701 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 13ddcd98-6f4a-40a8-8e24-29ca0aee4661
Oct. 08, 2025
Action Type Old Value New Value Added Description A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence team are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed. Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H Added CWE CWE-367 Added Reference https://www.crowdstrike.com/en-us/security-advisories/issues-affecting-crowdstrike-falcon-sensor-for-windows/