A local user can exploit a missing validation in the CoworkVMService component of Claude Desktop, which runs with SYSTEM privileges on Windows. The service fails to check whether the VM bundle directory is a legitimate path or an NTFS directory junction, allowing an attacker to replace the user‑writable directory with a junction pointing to a location of their choice. When the service creates files within the directory, those files are written with SYSTEM ownership, effectively granting the attacker SYSTEM‑level files and escalating local privileges.

Anthropics Claude Desktop version 1.3834.0 and earlier on Windows systems are affected. This applies to any installation that includes the CoworkVMService component before the 1.3834.0 fix.

The vulnerability has a CVSS score of 8.5, indicating a high severity local privilege escalation. No EPSS data is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting it has not yet been widely abused. The attack requires an authenticated local user with file‑write permissions to the VM bundle directory and no remote access. An attacker can create a directory junction pointing to an arbitrary location and cause the SYSTEM‑running service to generate files in that location, providing a path to elevate privileges to SYSTEM level.