{"id":"CVE-2026-22561","title":"Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking","summary":"Uncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-427","CWE-427"],"vendor":"anthropic","product":"claude","affected":["claude < 1.1.3363"],"patched":["claude 1.1.3363"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-22561","references":[{"url":"https://trust.anthropic.com/resources?s=1cvig6ldp3zvuj1yffzr11&name=cve-2026-22561-dll-search-order-hijacking-in-claude-for-windows-installer","label":"support@hackerone.com"}],"tags":["nvd"],"epss":0.00177,"epssPercentile":0.07505,"ingestedAt":"2026-07-24T20:38:02.169Z","slug":"CVE-2026-22561","body":"## Overview\n\nUncontrolled search path elements in Anthropic Claude for Windows installer (Claude Setup.exe) versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs (e.g., profapi.dll) from its own directory after UAC elevation, enabling arbitrary code execution if a malicious DLL is planted alongside the installer.\n\n## Affected\n\n- `claude < 1.1.3363`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `claude 1.1.3363`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}