The installer for Anthropic Claude Desktop for Windows loads DLL files from its own directory after user‑account‑control elevation. Because the search path is not constrained, a malicious DLL with the same name as a legitimate file – for example profapi.dll – can be placed beside the installer and will be loaded during installation. This allows an attacker who can run the installer on the target machine to execute arbitrary code with elevated privileges.

Users who have installed Anthropic Claude Desktop for Windows with any installer version earlier than 1.1.3363 are affected. The vulnerability exploits the Windows DLL search‑order mechanism, so it applies to any Windows environment capable of running the installer and contains that directory structure.

The CVSS score of 4.7 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is not common in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker must have local access, the ability to run the installer, and write permission to the installer’s directory to place a rogue DLL. Given these prerequisites, the risk is moderate but manageable by applying the vendor‑recommended fix.