Claude Desktop CVE-2026-44470

Attacker must already have an interactive or remote shell as a local non-elevated user on a Windows host with Claude Desktop installed and the CoworkVMService running as SYSTEM; the VM bundle directory must be in its default user-writable location and must not yet be locked by the service. Exploitation is limited to the Windows build (macOS/Linux unaffected), requires the attacker to win control of the bundle directory path before the service writes to it (a timing/order-of-operations constraint typical of junction attacks), and depends on finding a useful SYSTEM-writable target path whose contents lead to code execution or further privilege gain. No network exploitation is possible (AV:L), and the attack is not automatable per CISA SSVC.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) accurately reflects a local, low-complexity, low-privileged attack with no user interaction and high impact across confidentiality, integrity, and availability - yielding 8.5. CISA SSVC corroborates this: technical impact is total, but exploitation status is 'none' and the issue is not automatable, meaning realistic exploitation requires a local foothold and targeted action. EPSS (0.01%, 0th percentile) and the absence of KEV or public PoC confirm there is no observed in-the-wild activity. Prioritization should therefore be driven by exposure (number of Windows endpoints with Claude Desktop installed) rather than urgency from active threat - patch on a normal cadence unless your environment treats local privilege boundaries as critical (e.g., multi-user workstations, jump hosts, VDI).

A non-administrative user already logged onto a Windows workstation with Claude Desktop installed deletes or empties the user-writable VM bundle directory, replaces it with an NTFS directory junction pointing to a SYSTEM-protected location such as a privileged service's plugin directory, and then triggers CoworkVMService activity. The SYSTEM-running service follows the junction and creates an attacker-influenced file in the target directory, which the attacker leverages (e.g., via DLL planting or scheduled-task config drop) to obtain SYSTEM code execution. No public exploit identified at time of analysis, but directory-junction EoP techniques are well-documented and trivially adaptable.