CrowdStrike hires outside security outfits to review troubled Falcon code

CrowdStrike’s root cause analysis attributes the July 19 global Windows outages to a Falcon Rapid Response content update in which an IPC detection template attempted to access a missing 21st parameter, causing an out-of-bounds read in a kernel-mode interpreter and system crashes. The vendor has updated its content compiler to enforce correct parameter counts, added runtime bounds and size checks, is backporting hotfixes to Windows sensor 7.11 and above, moving to staged rollouts for content, and has hired external firms to review the involved code and processes.