EUVD-2026-38639
GHSA-g2fx-c284-xq7h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Local vector and low privileges as the user; integrity check bypass crosses the VM trust boundary (S:C) yielding high C/I and low A inside the VM.
Primary rating from Vendor (AHA).
CVSS VectorVendor: AHA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim macOS user can modify the VM root filesystem image and have it trusted on subsequent Cowork VM boots, enabling persistent arbitrary code execution in the VM and access to host-mounted directories. The estimated CWE mapping is CWE-353 (Missing Support for Integrity Check).
AnalysisAI
Persistent local code execution affects Anthropic Claude Desktop Cowork on macOS (v1.1348.0 through v1.2278.0) because the Cowork VM bootstrap validates only the presence of rootfs.img and a version marker string without verifying image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim user can swap or modify the root filesystem image so subsequent Cowork VM boots trust the tampered image, yielding persistent arbitrary code execution inside the VM and access to host-mounted directories. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Claude Desktop Cowork is Anthropic's desktop application that runs an isolated micro-VM on macOS to host agentic coding workflows; the VM is launched from a rootfs.img disk image stored on the host filesystem. The flaw is a CWE-353 (Missing Support for Integrity Check) weakness in the VM boot path: the launcher checks only that the image file exists and that an embedded version marker string is present, but never cryptographically verifies the image (no signature check, no measured hash against a trusted manifest) before mounting and executing it. Because the trust decision occurs at time-of-use against an attacker-writable artifact in the user's profile, any user-space process running as the victim can substitute its own filesystem image. The CPE cpe:2.3:a:anthropic:claude_desktop_cowork narrows the scope to the Cowork component specifically, not the broader Claude Desktop chat client.
RemediationAI
No vendor-released patch identified at time of analysis, so administrators should monitor Anthropic's Claude Desktop release notes and upgrade to any post-v1.2278.0 build that adds cryptographic verification of rootfs.img before booting the Cowork VM. As compensating controls until a fix ships, restrict which host directories are mounted into Cowork (minimize the blast radius if the VM is compromised), place the Cowork VM image directory under macOS endpoint monitoring or file-integrity tooling (Santa, EDR file-write telemetry, or fs_usage rules) to detect tampering of rootfs.img - accepting that detection lags prevention - and consider disabling or not launching Cowork on hosts where untrusted code may execute as the user, at the cost of losing the agentic VM workflow. Tightening macOS user-level controls (TCC, login-item review, and removing unnecessary local admin) reduces the pool of processes that could realistically modify the image. Cite the conference disclosure (https://cfp.recon.cx/recon-2026/talk/DZUQYU/) when tracking the issue internally.
Same weakness CWE-353 – Missing Support for Integrity Check
View allShare
External POC / Exploit Code
Leaving vuln.today