The vulnerability is caused by the Anthropic Claude Desktop Windows installer loading DLLs from the installer’s own directory without sanitizing the search path. A local user can place a malicious DLL in the same folder as Setup.exe after granting UAC elevation. When the installer loads the DLL, the code runs with elevated privileges, enabling arbitrary code execution and full control of the workstation.

Anthropic Claude Desktop for Windows versions earlier than 1.1.3363 are affected. The issue is confined to the local machine; remote attackers cannot exploit the vulnerability without user interaction or physical access to run the installer.

The CVSS score of 4.7 reflects moderate severity. No EPSS data or KEV listing is available, indicating a lower exploitation probability. Exploitation requires a local user to run the installer and approve a UAC prompt; thus the attack vector is local privilege escalation via DLL hijacking. While not easily remotely exploitable, the vulnerability remains a risk for environments trusting local users or running unattended installations.