CVE-2026-22561: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22561 is a DLL search-order hijacking vulnerability in the Anthropic Claude for Windows desktop installer (Claude Setup.exe) that allows local privilege escalation via arbitrary code execution. The flaw affects all versions of Claude Desktop for Windows prior to 1.1.3363 and was published on March 31, 2026, with the GitHub Advisory Database updated on April 6, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 4.7 (Medium), and was assigned via HackerOne (GitHub Advisory, Anthropic Trust).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). During installation, Claude Setup.exe performs a UAC elevation and subsequently loads DLLs — such as profapi.dll — from its own working directory rather than from the trusted Windows system directory. Because Windows DLL search order prioritizes the application's directory before system directories in certain contexts, an attacker who can write a malicious DLL with the same name into the directory containing the installer can cause it to be loaded with elevated privileges. No complex preconditions are required beyond local access to the filesystem path where the installer resides and the ability to trigger installer execution (GitHub Advisory, Anthropic Trust).

Successful exploitation allows an attacker with local access to execute arbitrary code in the context of the elevated installer process, effectively achieving SYSTEM-level or administrator-level privileges on the affected Windows host. This results in high impact to the confidentiality, integrity, and availability of the broader system (subsequent system scope), enabling full system compromise, credential theft, persistence mechanisms, and potential lateral movement within the network. The vulnerable system itself (the installer process) does not directly expose confidentiality or integrity data, but the elevated execution context grants control over the underlying OS (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.014% (0th percentile), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and user interaction (running the installer), which limits the attack surface compared to remote vulnerabilities.

1. Gain local access: Obtain a low-privileged local user account on the target Windows system where the Claude Desktop installer will be run.
2. Identify installer location: Determine the directory where Claude Setup.exe is stored or will be downloaded (e.g., the user's Downloads folder or a shared network path).
3. Craft malicious DLL: Create a malicious DLL named profapi.dll (or another DLL loaded by the installer) that contains the attacker's payload — for example, a reverse shell or a command to add a backdoor administrator account.
4. Plant the DLL: Copy the malicious profapi.dll into the same directory as Claude Setup.exe before the installer is executed.
5. Trigger installer execution: Wait for or socially engineer a privileged user to run Claude Setup.exe. When the installer triggers UAC elevation, it loads DLLs from its own directory.
6. Achieve elevated code execution: The malicious profapi.dll is loaded in the elevated installer context, executing the attacker's payload with administrator or SYSTEM-level privileges (GitHub Advisory, Anthropic Trust).

• File System: Presence of unexpected DLL files (e.g., profapi.dll) in the same directory as Claude Setup.exe (e.g., %USERPROFILE%\Downloads\ or other installer staging directories); DLL files with mismatched metadata (wrong version info, unsigned, or signed by an unknown publisher).
• Process: Unusual child processes spawned by Claude Setup.exe during installation (e.g., cmd.exe, powershell.exe, net.exe); processes running with elevated privileges that are not expected from a standard Claude installation.
• Logs: Windows Event Log entries (Event ID 4688) showing unexpected process creation under the Claude Setup.exe parent process; UAC elevation events (Event ID 4672) followed by anomalous subprocess activity.
• Network: Unexpected outbound network connections originating from the installer process or its child processes to unknown external IP addresses during or immediately after installation.

Anthropic has released a patched version of Claude Desktop for Windows; users should upgrade to version 1.1.3363 or later immediately (Anthropic Trust). As a workaround, restrict write permissions to directories containing installer executables so that unprivileged users cannot plant DLL files alongside them. Additionally, ensure installers are downloaded only from official Anthropic sources and verify file integrity before execution. Organizations should consider using application whitelisting or endpoint protection tools to block unsigned or unexpected DLL loads during installer execution.