Researcher Releases Zero-Day EDR Exploits Targeting CrowdStrike, Defender, and Avast
Security researcher Chaotic Eclipse has published a zero-day exploit named FalconFlank targeting CrowdStrike Falcon Sensor. The exploit demonstrates local privilege escalation by abusing the sensor's malicious macro remediation mechanism on fully updated Windows 11 25H2 and Windows Server 2025 systems. CrowdStrike confirmed it is investigating the issue and advised administrators to disable the specific Microsoft Office macro removal policy while relying on cloud protection features instead. This disclosure follows a string of similar privilege escalation releases by the same researcher targeting multiple endpoint security solutions. Prior to FalconFlank, the researcher dropped HardBreacher, a flaw in Kaspersky Endpoint Security for Windows that targets UI process control and drops an arbitrary DLL into `C:\Windows\System32\` with full user permissions. Kaspersky addressed the issue via automatic database updates shortly after public release. Another exploit, ShieldBreak (CVE-2026-69414), bypasses an earlier Microsoft Defender fix for CVE-2026-50656 by chaining Cloud Files API interactions, NT Object Manager namespace manipulation, and timing races during remediation to write `C:\Windows\System32\phoneinfo.dll` before obtaining `NT AUTHORITY\SYSTEM` execution via Windows Error Reporting. Additional public releases include PrettyPrague, which abuses Avast's sandbox to dump the SAM database and trigger a SYSTEM shell, and GreenSection, an NVIDIA memory corruption flaw crashing Vulkan and OpenGL applications. Gen Digital acknowledged the Avast vulnerability across related product lines and is currently developing a patch.
Commentary
Security agents frequently run with the highest operating system privileges (`NT AUTHORITY\SYSTEM` or kernel-level drivers) to inspect system activity, but their automated remediation workflows continue to present complex file-system race conditions and symlink/junction abuse vectors. When an EDR cleans up a malicious file or remediates an Office macro, redirecting privileged write and delete operations via NT Object Manager namespaces or filesystem APIs enables standard users to escalate privileges. CrowdStrike Falcon users should immediately check their Falcon policy configurations and disable the "Microsoft Office File Suspicious Macro Removal Windows" policy setting as recommended by the vendor, ensuring cloud anti-malware protections remain engaged. Avast and Gen Digital product administrators should monitor incoming patch releases for sandbox escalation issues. Defender deployments must track upcoming Patch Tuesday updates closely, as ShieldBreak actively bypasses previous remediations using native OS components like Windows Error Reporting (`WerFault.exe`) for persistence.
The Quote to Remember
“We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.”
“The result is a self-contained local privilege escalation chain in which Windows Defender's own clean engine is redirected to write an attacker-supplied DLL to C:\Windows\System32\phoneinfo.dll, followed by SYSTEM execution through the built-in Windows Error Reporting task.”