Virsec Sues CrowdStrike in Austin, Accusing Falcon of Infringing Two Memory Corruption Patents.

The complaint

The case is Virsec Systems, Inc. v. CrowdStrike, Inc. and CrowdStrike Holdings, Inc., No. 1:26-cv-03053 (W.D. Tex., Austin Division), a 16 page complaint for patent infringement filed October 30, 2026, ECF No. 1. Exhibits 1 and 2 are the patents, Exhibits 3 and 4 are CrowdStrike web pages on Hardware Enhanced Exploit Detection and on preventing malware with Falcon, and Exhibits 5 and 6 are claim charts for the '312 and '634 patents. The docket shows a request for issuance of summons, a notice of the patent filing to the USPTO, and a Rule 7 disclosure statement, all entered October 30.

The complaint describes Virsec as a Delaware corporation based in San Jose, California. It says CrowdStrike, Inc. is a Delaware corporation and a wholly owned subsidiary of CrowdStrike Holdings, Inc., also a Delaware corporation, and that both have offices in Austin, Texas. It alleges, on information and belief, that CrowdStrike Holdings controls or otherwise directs and authorizes the activities of CrowdStrike, Inc.

Jurisdiction and venue

The complaint pleads subject matter jurisdiction under 28 U.S.C. 1331 and 1338(a), and personal jurisdiction based on CrowdStrike's principal executive offices in the district and alleged acts of infringement there. It pleads venue under 28 U.S.C. 1391(b) and (c) and 1400(b), citing CrowdStrike's Austin offices, and alleges, on information and belief, that CrowdStrike employees there use the accused products in their everyday work and to develop and test them, and that engineers who design, develop, and maintain the accused products are located in Austin.

The two patents and the asserted claims

The complaint says both patents stem from provisional application 60/771,734, filed February 9, 2006, and application 11/673,541, filed February 9, 2007, and that the '312 patent issued February 24, 2015 and the '634 patent on March 7, 2023. It alleges that Virsec holds all rights, title, and interest in both. The face of the '634 patent identifies it as a continuation of the application that issued as U.S. Patent No. 10,331,888, which in turn continues the application that issued as the '312 patent.

Claim 1 of the '312 patent covers a method of detecting, at run time, an application layer memory corruption of a control section of original memory by malicious code, where the corruption would otherwise affect the application's execution flow. Detection uses at least two different invariant checks. Each check captures the state of one or more registers and part of a data segment of the control section before a function call, checks the state after the call against what was captured, and declares a memory corruption if they do not match. The method then reports the corruption to a user.

Claim 1 of the '634 patent covers detecting an application layer memory corruption of a return address control section of a stack. When a function is called, a first interrupt instruction, mapped in a list in memory to a first instruction and instrumented to temporarily replace it, intercepts that instruction, captures a shadow copy of the calling address, and executes the instruction. When the called function returns, a second mapped interrupt instruction intercepts a second instruction and checks the current return address against the shadow copy. The method declares a memory corruption if the two do not match and reports it to a user.

The complaint describes the problem the patents address as memory corruption attacks, such as buffer overflow, format string, and heap metadata attacks and the hijacking of pointers that control execution flow, and describes the patents' approach as checking structural invariants at run time against previously captured or expected state.

What CrowdStrike technology is accused

The accused products are the CrowdStrike Falcon platform, including the Falcon sensor for operating systems such as Windows, Linux, and macOS with its Hardware Enhanced Exploit Detection and exploit mitigation features, Falcon Prevent, Falcon Insight XDR, the Falcon Complete managed detection and response service, and other Falcon modules, subscriptions, and services that include or use those features, including the Falcon Go, Falcon Pro, and Falcon Enterprise bundles.

The complaint alleges that CrowdStrike announced Hardware Enhanced Exploit Detection in December 2021 and describes it as detecting return-oriented programming and other code-reuse exploits on Windows computers, in part by maintaining a "shadow stack" that records the addresses of call instructions and checks whether the targets of return instructions match them. It alleges, on information and belief, that CrowdStrike intercepts functions at their entry points to prevent the execution of potentially malicious code.

The counts and the knowledge allegations

Count I, on the '312 patent, and Count II, on the '634 patent, each allege direct infringement of at least claim 1 under 35 U.S.C. 271(a) by using the accused products. Each alleges, on information and belief, that CrowdStrike uses the Falcon sensor to protect its own computers, operates the accused products for customers through Falcon Complete, and performs the claimed method when developing and testing the products. Exhibits 5 and 6 chart claim 1 of each patent.

Each count also alleges induced infringement under 35 U.S.C. 271(b), citing CrowdStrike's instructions to customers to install the Falcon sensor and enable exploit mitigation through Falcon prevention policies, and contributory infringement under 35 U.S.C. 271(c), naming the Hardware Enhanced Exploit Detection and exploit mitigation components. For knowledge, the complaint alleges that CrowdStrike has known of each patent at least as of the filing and service of the complaint.

The relief sought

The prayer asks for a judgment of direct, induced, or contributory infringement, compensatory damages including lost profits and no less than a reasonable royalty, pre-judgment and post-judgment interest, attorney fees and costs under 35 U.S.C. 285, and an accounting and supplemental damages from six years before filing through final judgment. The complaint demands a jury.

Other Virsec suits on the '312 patent

Virsec asserted the '312 patent, together with U.S. Patent No. 10,331,888, in two earlier complaints in the same court in October 2026: No. 1:26-cv-02934, filed October 16, 2026, and No. 1:26-cv-02992, filed October 23, 2026.

What to watch next

Watch for a judge assignment, service on CrowdStrike, and an answer, a Rule 12 motion, or a motion to transfer venue.

Also watch for petitions for inter partes review of the '312 or '634 patent at the Patent Trial and Appeal Board.