Vulnerabilities CVE-2026-22561

CVE-2026-22561

Medium

Open

TLP:CLEAR

AI Analysis

No AI analysis yet.

Description

Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enabling arbitrary code execution if a malicious DLL is planted alongside the installer.

Details

CVSS Score: 4.7
EPSS Score ⓘ: 0.18%

7.5th percentile
CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Confidence: 90%
Published: Mar 31, 2026
Last Modified: May 10, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.