CVE-2026-22561

Executive Summary

CVE-2026-22561 is a local privilege escalation vulnerability in the Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363. The installer exhibits an uncontrolled search path element (CWE-427) that causes it to load DLLs — including profapi.dll — from its own working directory after UAC elevation, rather than exclusively from the system directory. A local attacker who can place a malicious DLL alongside the installer binary will achieve code execution in the context of the elevated installer process. With a CVSS score of 4.7 (Medium), this vulnerability poses a meaningful risk to enterprise endpoints where Claude is deployed via shared network shares or user-writable directories.

Technical Analysis

The vulnerability stems from a flawed DLL search order in Claude Setup.exe versions prior to 1.1.3363. Windows uses a well-documented DLL search order: 1) the directory from which the application loaded, 2) the system directory, 3) the 16-bit system directory, 4) the Windows directory, and 5) the current working directory. When a process is elevated via UAC, the installer inherits the full privileges of the administrative token but often does not correctly reset or sanitize its current working directory or the path from which it was launched.

The installer on launch loads profapi.dll (a Windows Profile API DLL) via a standard LoadLibrary-style dynamic import. Because the application search path is prioritized ahead of the system directory, Windows resolves the import by first checking the directory containing Claude Setup.exe. If an attacker has placed a crafted profapi.dll file into that same directory — either because the installer was copied to a shared folder, a user-downloads directory co-used by multiple accounts, or a removable drive — the malicious DLL is loaded instead of the legitimate system one.

The elevation chain functions as follows:

1. The attacker identifies a location where the Claude installer is stored and has write access (e.g., a shared D:\Software\ folder, a low-privilege user's Downloads folder that is later invoked from an administrative context, or a staging directory used by IT).
2. The attacker drops a malformed profapi.dll containing a DllMain payload into that directory.
3. When the administrator (or a user with UAC elevation rights) executes Claude Setup.exe, the process is elevated. The Windows loader searches the executable directory first, locates the attacker's DLL, and loads it before the legitimate profapi.dll.
4. The malicious DllMain runs in the context of the elevated process, giving the attacker code execution with Administrator privileges.

The key technical weakness is the installer's failure to enforce the SafeDllSearchMode registry setting or to explicitly call LoadLibrary with a hardcoded full path to profapi.dll. A properly hardened installer would either statically link the API, use SetDllDirectory("") to strip the application directory from the search path, or LoadLibraryEx with LOAD_LIBRARY_SEARCH_SYSTEM32.

Exploitation Scenarios

Scenario 1: Shared Network Installation Folder

1. Reconnaissance: The attacker, a low-privileged local user, enumerates the filesystem and identifies C:\Temp\Claude Setup.exe (a folder used by IT for software staging) or \\corp-files\Software\Claude\Claude Setup.exe. The attacker confirms write permissions via icacls on the directory.
2. Weaponization: The attacker crafts a malicious profapi.dll using a tool like msfvenom (windows/x64/meterpreter/reverse_tcp) embedded in a DllMain function. The DLL exports the minimal set of functions required for the loader to accept it — at minimum, DllMain.
3. Trigger: The attacker places the DLL in the target directory and waits. An IT administrator later runs the installer from this shared location during a software rollout. The elevated installer loads the malicious DLL.
4. Payload Execution: The DllMain executes during process initialization — before any signed-catalog validation of the installer. A reverse shell is initiated to the attacker's C2, now running with SYSTEM/Administrator privileges.
5. Post-Exploitation: The attacker elevates from the network service or standard user context to full administrative control of the endpoint, disables Defender via Set-MpPreference -DisableRealtimeMonitoring $true, dumps SAM/SYSTEM hives, and moves laterally through the domain.

Scenario 2: User Downloads Folder

1. Reconnaissance: The attacker (an unprivileged user) knows that shared workstations are deployed where several users log in sequentially. They target C:\Users\Public\Downloads\Claude Setup.exe — a location IT uses to stage installers.
2. Weaponization: The attacker writes a keylogger module compiled as profapi.dll.
3. Trigger: A subsequent administrator logs in, runs the staged installer with UAC acceptance.
4. Execution: The DLL is elevated and persists via a scheduled task (schtasks /create /tn "SysHelper" /tr "C:\Users\Public\keylog.dll" /sc onlogon).
5. Impact: The attacker captures corporate credentials of the next legitimate administrator who logs in, enabling full domain takeover via the captured Domain Admin token.

The privilege escalation is reliable — there is no ASLR bypass required because the loader pulls the DLL from a fixed, predictable path. The attacker only needs write access to the installation directory, which is commonly misconfigured in enterprise software staging areas.

Impact Assessment

The CVSS score of 4.7 (Medium) reflects the need for local access (AV:L), a high attack complexity (AC:H) due to the need for a victim to execute the installer, and low privileges (PR:L) required from the attacker. The confidentiality impact is rated High (C:H) because the attacker obtains code execution with administrative privileges. Integrity impact is High (I:H) — the attacker can alter any file on the system, and the availability impact is High (A:H) — the attacker can disrupt the system.

Business Impact: The installer is commonly deployed by enterprises adopting Claude for Windows. The primary blast radius is compromised endpoints leveraged for data exfiltration, credential harvesting, and lateral movement. In environments where installers are staged on network shares, a single instance of profapi.dll poisoning can compromise multiple endpoints across the enterprise. The hackerone / Unknown CNA attribution suggests this was disclosed through a coordinated vulnerability disclosure program, indicating Anthropic was aware of the issue at disclosure time.

Affected Systems: All Windows endpoints running Claude Setup.exe prior to version 1.1.3363. Both 32-bit and 64-bit Windows variants are affected. The attack is only locally exploitable; however, the medium severity understates the strategic risk because an attacker who can poison a software repository compromises the supply chain.

Detection Guidance

Sigma Rule

title: Suspicious DLL Dropped Alongside Claude Installer
status: experimental
description: Detects the presence of profapi.dll or other unusual DLLs in the same directory as Claude Setup.exe, which indicates potential DLL search-order hijacking for CVE-2026-22561.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22561
logsource:
    product: windows
    category: file_event
detection:
    selection_dll:
        TargetFilename|endswith:
            - '\\profapi.dll'
    selection_dir:
        TargetFilename|contains:
            - 'Claude Setup.exe'
    condition: selection_dll
falsepositives:
    - Legitimate system profapi.dll copies in C:\Windows\System32 (filter by path)
level: high

YARA Rule

rule CVE_2026_22561_DLL_Hijack_Claude_Setup {
    meta:
        author = "ValtersIT SOC"
        description = "Detects suspicious DLLs targeting the Claude Setup.exe directory"
        cve = "CVE-2026-22561"
        date = "2026-01-15"
    strings:
        $s1 = "DllMain" ascii wide
        $s2 = "profapi.dll" ascii wide nocase
        $s3 = "LoadLibrary" ascii wide nocase
        $mz = {4D 5A}          // MZ header
    condition:
        $mz at 0 and 1 of ($s*) and filesize < 2MB
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-22561 - Potential DLL Hijack Payload Download for Claude Installer"; flow:to_client,established; content:"profapi.dll"; nocase; content:"Claude Setup.exe"; nocase; classtype:attempted-admin; sid:202622561; rev:1;)

Elastic Detection

file where event.action == "creation" and
  file.name == "profapi.dll" and
  not file.path startswith "C:\\Windows\\System32" and
  (file.path startswith "C:\\Users" or file.path startswith "C:\\Temp" or file.path startswith "\\\\") and
  not file.path contains "\\Windows\\WinSxS\\"

Splunk SPL Query

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where Image = "*profapi.dll" AND Image !IN ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*", "C:\\Windows\\WinSxS\\*")
| eval cve = "CVE-2026-22561"
| stats count by Image, DestinationDirectory, User, Computer
| where count > 1
| table _time, Computer, User, Image, DestinationDirectory, count

Wazuh OSSEC Rule

<group name="dll_hijack,">
  <rule id="100225" level="12">
    <decoded>file_create</decoded>
    <field name="file" type="pcre2">(?i)\\profapi\.dll$</field>
    <field name="path" type="pcre2">(?i)(?!C:\\Windows\\(system32|syswow64|winsxs)\\?$).*</field>
    <description>CVE-2026-22561: Potentially malicious profapi.dll dropped outside system directories for Claude installer DLL hijacking</description>
    <mitre>
      <id>T1574</id>
    </mitre>
    <group>dll_hijack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The patch status is 0/4 UNPATCHED — no patch evidence is available from tracked sources. However, the NVD description explicitly states the vulnerability exists "prior to 1.1.3363," which confirms a patched version 1.1.3363 exists. The hackerone / Unknown CNA attribution strongly suggests disclosure was handled through Anthropic's bug bounty program, and a silent or coordinated fix was likely released. Enterprises should verify the deployed version.

Immediate Mitigations:

1. Update Claude for Windows to version 1.1.3363 or later. Check the application's About dialog or the installed version in Control Panel\Programs\Programs and Features.
2. Harden installation directories: Ensure that Claude Setup.exe is only executed from protected locations (e.g., C:\Windows\Installer\ or an IT-managed repository where non-administrators lack write access). Audit share permissions on network staging folders — remove "Everyone: Write" and "Authenticated Users: Write".
3. Enable the SafeDllSearchMode registry key: Set HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1 (DWORD). This forces the loader to search the system directory before the application directory in most cases, mitigating the hijack.
4. Use SetDllDirectory policy via Group Policy "Run these programs at user logon" to call SetDllDirectory("C:\Windows\System32") before installer execution, if the environment supports it.
5. AV/EDR blocking rule: Block DLL loading from directories that contain Claude Setup.exe or any installer binary, excluding the standard Windows directories.

Patch/Upgrade Steps:

1. Download the updated installer from the official Anthropic distribution channel.
2. Copy the new Claude Setup.exe to a temporary directory, execute and complete the upgrade.
3. Verify the installed version is 1.1.3363 or greater via wmic product where "name like '%Claude%'" get version.
4. If the version cannot be verified or the installer is locked, contact Anthropic support for a direct patch distribution.

Long-Term Hardening:

1. Repackage the installer using an MSI transformation that sets SecureCustomProperties and removes the currentDirectory search path — or enforce the use of the MSI-based deployment via GPO rather than raw EXE execution.
2. AppLocker / WDAC: Enforce application control policies that permit execution of Claude Setup.exe only from approved directories, and block DLL loading from writable paths via Windows Defender Application Control (WDAC) rule FilePublisher allow-lists.
3. Regular vulnerability scanning of endpoint software inventories for Claude versions below 1.1.3363 via SCCM or Intune compliance policies.
4. Enable tamper protection on all installer shares; restrict write access to IT admins via a dedicated AD security group.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-22561
2. Anthropic Claude Download Page: https://claude.ai/download
3. Anthropic Security Advisory (expected at publication): https://support.anthropic.com/security-advisories
4. MITRE ATT&CK — Hijack Execution Flow (T1574): https://attack.mitre.org/techniques/T1574/
5. CISA KEV Catalog — not listed (no known in-the-wild exploitation as of report date).

Exploit-in-the-Wild Evidence: No public exploit code, PoC, or Nuclei template exists at the time of writing. EPSS places this at the 7.4th percentile of exploited CVEs, indicating low but non-zero exploitation likelihood. The vulnerability has not been added to the CISA KEV catalog. No known threat actor campaigns have leveraged this flaw; however, DLL search-order hijacking is a well-understood and frequently weaponized technique by commodity malware families — this CVE is a prime candidate for weaponization once patches are bypassed or installers are repackaged with malicious DLLs in software-download mirrors.