Claude Desktop Windows EUVD-2026-17476

The CVSS v4.0 base score of 4.7 reflects a low attack vector (local only, AV:L), low complexity (AC:L), and low privilege requirement (PR:L), but indicates high impact on system integrity and availability (SI:H, SA:H). The attack requires user interaction (UI:P)-specifically, an elevated user must execute the installer-which adds practical friction. However, exploitation is trivial once a malicious DLL is staged, and the technical impact reaches system level. The exploitation status shows no public exploit code or KEV confirmation; this is a client-side installer vulnerability with limited attack surface compared to network-facing vulnerabilities, reducing real-world priority relative to the CVSS score. SSVC considerations: exploitation is not confirmed active, automatable via DLL placement (moderately easy), and technical impact is high (code execution at system privilege level). Organizations should prioritize this as a medium risk for users with admin rights who download and execute the installer, but it does not represent an immediate widespread threat like a remote code execution flaw.

A local attacker with standard user privileges identifies that an organization's administrator will update Claude Desktop. The attacker plants a malicious profapi.dll in the directory where the installer binary resides (e.g., a shared download folder or temp directory with loose permissions). When the administrator launches Claude Setup.exe to perform an update, UAC elevation occurs, and the Windows loader prioritizes the malicious DLL in the installer's directory over the system copy. The attacker's code executes with system privileges, allowing installation of persistent backdoors or lateral movement within the network. This scenario is most practical in multi-user or shared-system environments where directory permissions are not strictly controlled.