CVE-2026-44470 Overview
CVE-2026-44470 is a local privilege escalation vulnerability in the Claude Desktop application for Windows. The flaw resides in the CoworkVMService component, which runs as SYSTEM. The service does not validate whether the VM bundle directory is a legitimate directory or an NTFS directory junction before writing files into it. A local non-elevated user can replace the user-writable VM bundle directory with a junction pointing to an attacker-chosen location. The service then creates a SYSTEM-owned file at that target, enabling privilege escalation. Anthropic fixed the issue in Claude Desktop version 1.3834.0. The vulnerability maps to CWE-59: Improper Link Resolution Before File Access.
Critical Impact
A local low-privileged user can escalate to SYSTEM by abusing an NTFS junction to redirect file creation by the CoworkVMService.
Affected Products
- Claude Desktop for Windows prior to 1.3834.0
- CoworkVMService component running as SYSTEM
- Anthropic Claude Code graphical desktop client
Discovery Timeline
- 2026-05-13 - CVE-2026-44470 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44470
Vulnerability Analysis
The vulnerability stems from missing link resolution checks in the CoworkVMService Windows service. The service operates under the SYSTEM account and writes files into a VM bundle directory located within a user-writable path. Because the service performs no validation of the path type before file creation, a standard user retains the ability to manipulate the directory entry.
NTFS directory junctions allow a folder to act as a redirect to another filesystem location. When the service writes to the bundle directory, the kernel transparently resolves the junction and places the file at the redirected target. The newly created file inherits the SYSTEM security context.
This primitive enables arbitrary file write as SYSTEM, which is a well-known path to local privilege escalation on Windows.
Root Cause
The root cause is improper link resolution before file access [CWE-59]. The service trusts the directory handle without calling APIs such as GetFileInformationByHandleEx with FileAttributeTagInfo or opening the path with FILE_FLAG_OPEN_REPARSE_POINT to detect reparse points. No ACL hardening prevents a standard user from converting the bundle folder into a junction.
Attack Vector
The attack requires local access and low privileges. The attacker deletes or empties the existing VM bundle directory, then recreates it as an NTFS junction pointing to a sensitive system location such as C:\Windows\System32 or a path tied to a privileged DLL search order. When CoworkVMService next writes to the bundle path, the file is created at the attacker-controlled destination with SYSTEM ownership. The attacker then leverages this write primitive — for example, by planting a DLL or replacing a scheduled task payload — to achieve code execution as SYSTEM.
No proof-of-concept exploit code is publicly available. Refer to the GitHub Security Advisory GHSA-5p5x-5294-qhp3 for vendor technical details.
Detection Methods for CVE-2026-44470
Indicators of Compromise
- Presence of an NTFS reparse point or directory junction at the Claude Desktop VM bundle path under a user profile directory.
- SYSTEM-owned files created in directories outside the expected Claude Desktop installation tree, such as C:\Windows\System32 or service binary paths.
- Unexpected file creation events by CoworkVMService.exe writing outside %LOCALAPPDATA%\Anthropic or the application install directory.
Detection Strategies
- Monitor process file activity from CoworkVMService.exe for write operations resolving to paths outside its expected working directory.
- Audit Windows Event ID 4663 for file creation events where the subject is SYSTEM and the parent process is CoworkVMService.exe targeting unusual locations.
- Use fsutil reparsepoint query or Sysinternals junction.exe to scan user profile directories for unexpected reparse points associated with the Claude Desktop bundle path.
Monitoring Recommendations
- Enable file system auditing on the VM bundle parent directory and alert on reparse point creation by non-administrative users.
- Inventory Claude Desktop versions across managed Windows endpoints and flag any build earlier than 1.3834.0.
- Correlate junction creation events with subsequent service activity to identify exploitation attempts in progress.
How to Mitigate CVE-2026-44470
Immediate Actions Required
- Upgrade Claude Desktop for Windows to version 1.3834.0 or later on all affected endpoints.
- Restart the host or the CoworkVMService after the upgrade to ensure the patched binary is loaded.
- Audit existing VM bundle directories for pre-existing reparse points that may indicate prior exploitation.
Patch Information
Anthropic released the fix in Claude Desktop 1.3834.0. The patched CoworkVMService validates the target directory and rejects reparse points before creating files. Details are published in the GitHub Security Advisory GHSA-5p5x-5294-qhp3.
Workarounds
- Stop and disable the CoworkVMService Windows service on endpoints that cannot be patched immediately.
- Restrict ACLs on the VM bundle parent directory to block standard users from creating reparse points, denying the SeCreateSymbolicLinkPrivilege where feasible.
- Remove Claude Desktop from shared or multi-user Windows hosts until patching is complete.
# Configuration example: verify installed version and disable the vulnerable service
(Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object { $_.DisplayName -like "Claude*" }).DisplayVersion
Stop-Service -Name "CoworkVMService" -Force
Set-Service -Name "CoworkVMService" -StartupType Disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
