CVE-2026-22561: Claude for Windows Privilege Escalation Flaw

CVE-2026-22561 Overview

CVE-2026-22561 is a DLL Search Order Hijacking vulnerability affecting the Anthropic Claude for Windows installer (Claude Setup.exe) in versions prior to 1.1.3363. The vulnerability stems from uncontrolled search path elements that allow local privilege escalation. When the installer is executed and UAC elevation occurs, it loads DLLs (such as profapi.dll) from its own directory rather than trusted system paths. An attacker who can plant a malicious DLL alongside the installer can achieve arbitrary code execution with elevated privileges.

Critical Impact

Local attackers can achieve privilege escalation by planting a malicious DLL in the same directory as the Claude for Windows installer, leading to arbitrary code execution with elevated privileges when a user runs the installer.

Affected Products

• Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363

Discovery Timeline

• 2026-03-31 - CVE-2026-22561 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-22561

Vulnerability Analysis

This vulnerability is classified as a DLL Search Order Hijacking issue, which falls under the broader category of uncontrolled search path vulnerabilities. The core issue lies in how the Claude for Windows installer resolves and loads dynamic-link libraries during execution.

When a Windows application loads a DLL without specifying a fully qualified path, Windows follows a predefined search order to locate the library. The vulnerable installer searches its own directory early in this sequence, before checking secure system directories. This behavior becomes exploitable when the installer runs with elevated privileges after UAC consent is granted.

The attack requires local access and user interaction—specifically, a victim must execute the installer from a directory containing the attacker-controlled DLL. Common attack scenarios include placing the malicious installer bundle in shared directories, download folders, or removable media where users commonly execute downloaded software.

Root Cause

The root cause is improper DLL loading practices in the installer. The Claude Setup.exe application loads DLLs such as profapi.dll without specifying absolute paths, relying instead on the Windows DLL search order. Because the application's directory takes precedence over system directories in the default search order, a malicious DLL placed alongside the executable will be loaded instead of the legitimate system DLL.

This is a common vulnerability pattern in Windows installers, particularly those that run with elevated privileges. The installer should either specify absolute paths to system DLLs, use SetDllDirectory to control the search path, or implement DLL redirection manifests to ensure only trusted libraries are loaded.

Attack Vector

The attack is local in nature and requires the following conditions:

1. An attacker must have local access or the ability to write files to a directory where the victim will execute the installer
2. The attacker plants a malicious DLL (e.g., profapi.dll) in the same directory as Claude Setup.exe
3. A user with standard privileges runs the installer and approves the UAC elevation prompt
4. The installer loads the malicious DLL with elevated privileges, executing the attacker's payload

The vulnerability mechanism involves Windows DLL search order behavior. When Claude Setup.exe calls LoadLibrary for profapi.dll without a full path, Windows searches the application directory first. The malicious DLL exports the same functions as the legitimate library but includes additional malicious code that executes upon load. Since this occurs after UAC elevation, the malicious code runs with administrative privileges.

For technical details and vendor guidance, refer to the Anthropic Security Resource.

Detection Methods for CVE-2026-22561

Indicators of Compromise

• Presence of unexpected DLL files (particularly profapi.dll or other Windows system DLLs) in the same directory as Claude Setup.exe
• Unusual process behavior or child processes spawned by the installer
• DLL loading events from non-system directories during installer execution
• Evidence of privilege escalation attempts following installer execution

Detection Strategies

• Monitor for DLL loading from non-standard paths during installer execution, particularly DLLs with names matching common Windows system libraries
• Implement application whitelisting to prevent execution of unsigned or unexpected DLLs alongside installers
• Use SentinelOne's behavioral AI to detect anomalous code execution patterns during software installation processes
• Deploy file integrity monitoring in common download directories to detect planted DLLs

Monitoring Recommendations

• Enable detailed process and DLL loading audit events in Windows Security logs (Event IDs 4688, 7045)
• Monitor download directories, temp folders, and removable media for suspicious DLL files alongside installer executables
• Configure endpoint detection to alert on DLL sideloading patterns, especially when UAC elevation is involved

How to Mitigate CVE-2026-22561

Immediate Actions Required

• Update to Anthropic Claude for Windows installer version 1.1.3363 or later immediately
• Verify the integrity of downloaded installers using official checksums before execution
• Run installers only from trusted, clean directories—preferably dedicated installation folders with restricted write access
• Remove any suspicious DLL files from directories containing the installer prior to execution

Patch Information

Anthropic has addressed this vulnerability in Claude for Windows installer version 1.1.3363. Users should download the latest installer directly from official Anthropic distribution channels. The Anthropic Security Resource provides additional details regarding the fix.

Workarounds

• Execute the installer from a newly created, empty directory to prevent DLL hijacking
• Copy the installer to a protected directory with restricted write permissions before execution
• Use software restriction policies or application control solutions to prevent execution of unsigned DLLs
• Run the installer in a sandboxed environment or virtual machine for additional isolation

# Create a secure installation directory and execute installer
mkdir C:\SecureInstall
copy "Claude Setup.exe" C:\SecureInstall\
cd C:\SecureInstall
"Claude Setup.exe"