AnthropicGHSA-5p5x-5294-qhp3
Local Privilege Escalation via Directory Junction in CoworkVMService
High8.5CVE-2026-44470 · Published May 6, 2026
The CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged for local privilege escalation. Users are advised to update to the latest version of Claude Desktop for Windows. Thank you to hackerone.com/piquo for reporting this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Claude Desktop Product | < 1.3834.0 | 1.3834.0 |
Details and references
More Anthropic advisories
All Anthropic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 20 | Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration | Medium5.3 | 1.0.74 |
| May 6 | SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions | High7.4 | 1.4304.0 |
| Apr 24 | Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool | Medium4.8 | 0.91.1 |
| Apr 24 | Trust Dialog Bypass via Git Worktree Spoofing Allows Arbitrary Code Execution | High7.7 | 2.1.84 |
| Apr 20 | Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace | High7.7 | 2.1.64 |
| Apr 17 | Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows | Medium5.4 | 2.1.75 |