CVE-2026-7574

Executive Summary

CVE-2026-7574 affects Anthropic Claude Desktop Cowork VM image handling in versions 1.1348.0 through 1.2278.0. The application validates only file presence and a version marker string before booting rootfs.img without performing content integrity verification at time-of-use. A local attacker with unprivileged code execution as the victim macOS user can modify the VM root filesystem image, achieving persistent arbitrary code execution inside the VM and access to host-mounted directories. The CVSS score is 8.7 (High).

Technical Analysis

The vulnerability stems from missing integrity verification on the Cowork VM root filesystem image. The desktop application (confirmed in v1.1348.0, v1.1617.0, and v1.2278.0) checks only for the existence of rootfs.img and a static version marker string prior to boot. No cryptographic hash, digital signature, or content validation occurs at load time. This maps directly to CWE-353 (Missing Support for Integrity Check). The attack surface is the local filesystem path used by the macOS user account running Claude Desktop; an attacker with write access to that path can replace or patch the image contents. Subsequent VM boots trust and execute the altered rootfs, granting the attacker control inside the VM and visibility into any host directories mounted into the guest.

Exploitation Scenarios

1. Reconnaissance: Attacker runs code as the victim macOS user and locates the Cowork VM image directory used by Claude Desktop.
2. Trigger/weaponization: Attacker replaces or patches rootfs.img, preserving only the version marker string to pass the presence check.
3. Payload/execution: On next Cowork VM boot, the application loads the modified image without integrity verification, executing attacker-controlled code inside the VM.
4. Post-exploitation: Attacker establishes persistence within the VM, accesses host-mounted directories, and exfiltrates data or performs further lateral movement from the guest context.

Impact Assessment

The flaw enables local persistence and host-to-guest boundary crossing on affected macOS systems running Claude Desktop. Blast radius includes arbitrary code execution inside the VM with access to shared host paths. CVSS 8.7 reflects high confidentiality, integrity, and availability impact under local attack vector with changed scope. Affected organizations using Anthropic Claude Desktop for internal workflows face data exposure and unauthorized VM-level execution.

Detection Guidance

Sigma Rule

title: Anthropic Claude Desktop Cowork VM Image Modification
id: 8f3c2e1a-4b5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects modification of rootfs.img used by Claude Desktop Cowork VM
logsource:
  product: macos
  service: filesystem
detection:
  selection:
    TargetFilename|endswith: 'rootfs.img'
    EventType: 'File modification'
  condition: selection
fields:
  - TargetFilename
  - User
falsepositives:
  - Legitimate Claude Desktop updates
level: high

YARA Rule

rule Anthropic_Claude_Cowork_VM_Image_Tamper {
    meta:
        description = "Detects potential tampering indicators in Claude Desktop rootfs.img"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $marker = "version_marker_string"
        $suspicious = { 90 90 90 90 } // example nop sled or patched content
    condition:
        $marker and filesize > 100MB and $suspicious
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"Claude Desktop VM image access anomaly"; flow:established; content:"rootfs.img"; sid:20267574; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [file where file.name == "rootfs.img" and event.action == "modification"]
  [process where process.name == "Claude Desktop"]

Splunk SPL Query

index=macos filesystem EventCode=filesystem_modification TargetFilename="*rootfs.img" 
| stats count by User, TargetFilename, _time 
| where count > 0

Wazuh OSSEC Rule

<rule id="824187" level="12">
  <if_sid>550</if_sid>
  <match>rootfs.img</match>
  <description>Anthropic Claude Desktop Cowork VM image modified</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict write access to the Cowork VM image directory using macOS file permissions or endpoint controls; monitor the directory for unexpected modifications via file integrity monitoring.
2. Patch/upgrade steps: No vendor fix available; monitor Anthropic release notes for future updates addressing image validation.
3. Long-term hardening: Implement application-level content signing and verification for all VM images; deploy runtime attestation for guest filesystems.

References

NVD entry for CVE-2026-7574 Anthropic security advisories (none published) CISA KEV list (not included) No known threat actor campaigns or in-the-wild exploitation recorded.