Listen to this Post
The flaw resides in the CoworkVMService, a Windows service running with SYSTEM privileges. This component is responsible for managing a VM bundle directory on the local file system, which is writable by a standard, non-elevated user. The service, as part of its normal operation, creates new files inside this directory. The critical oversight is that the service does not validate the nature of the target path before performing file creation. It fails to distinguish between a standard directory and an NTFS Directory Junction (a type of reparse point similar to a symbolic link for directories). An attacker can exploit this by first locating the user-writable VM bundle directory. They then delete the original directory (for which they have write permission) and create an NTFS directory junction in its place. This junction can be configured to point to any arbitrary, high-stakes location on the file system, such as C:\Windows\System32. When the `CoworkVMService` writes a file, it follows the directory junction and creates a file at the attacker’s target location. Because the service has SYSTEM privileges, the newly created file is owned by the SYSTEM account. A typical attack scenario involves creating a new account with elevated privileges. For example, by writing a file that contains a malicious scheduled task or by creating a DLL in a system directory that will be executed by another high-privilege process. In essence, the vulnerability transforms a low-privilege user’s ability to control a file path into a direct local privilege escalation opportunity. The vulnerability is fixed in version 1.3834.0 by implementing proper validation to verify the target path is a standard directory and not a reparse point before any write operations are performed.
DailyCVE Form:
Platform: Windows
Version: pre-1.3834.0
Vulnerability : LPE JUNCTION
Severity: HIGH (8.5)
date: 2026-05-13
Prediction: 2026-05-20
What Undercode Say:
Analytics & Bash Commands:
Query CVE Details:
curl -s https://cve.circl.lu/api/cve/CVE-2026-44470 | jq '.'
Check Claude Desktop Version:
Windows (PowerShell) Get-AppxPackage -Name "Anthropic.ClaudeDesktop" | Select-Object -ExpandProperty Version
Check for Directory Junction Vulnerability:
Windows (cmd)
dir /al <path-to-vm-bundle-directory>
or PowerShell
Get-ChildItem <path-to-vm-bundle-directory> -Force | Where-Object { $_.LinkType -eq "Junction" }
Exploit:
The attack vector is entirely local and requires no user interaction.
1. Identify Target:
Locate the user-writable VM bundle directory.
2. Prepare Environment:
Delete the existing directory:
rmdir /s /q <VM_Bundle_Path>
3. Create Malicious Junction:
mklink /J <VM_Bundle_Path> \Windows\System32\Tasks\Malicious
4. Trigger CoworkVMService:
Wait for or cause the CoworkVMService to initiate a routine operation (e.g., starting a new Co-working VM session). The service will follow the link and create a SYSTEM-owned file in \Windows\System32\Tasks\.
5. Elevate Privileges:
The file created in `\Windows\System32\Tasks\` will be executed by the SYSTEM account on the next boot or scheduled trigger, effectively granting the attacker SYSTEM-level privileges.
Protection:
The primary mitigation is to update to Claude Desktop version 1.3834.0. If an immediate update is not possible, the following can be applied:
Restrict Write Access: Reduce user write permissions to the VM bundle directory and its parent folder.
Monitor Directory Creation: Use Windows auditing to log any `CreateJunction` events on critical paths or the known bundle directory.
Reparse Point Validation: The fixed version now implements validation checks to ensure a path is a real directory before writing.
Impact:
The vulnerability allows a local, low-privileged attacker to perform a Local Privilege Escalation (LPE). The overall CVSS 4.0 score is 8.5 (HIGH), reflecting:
Attack Vector (AV:L): Local.
Attack Complexity (AC:L): Low, no complex conditions required.
Privileges Required (PR:L): Only low-level user access is needed.
Confidentiality (VC:H), Integrity (VI:H), Availability (VA:H): Complete loss of system integrity, confidentiality, and availability for the vulnerable system.
Subsequent System (SC:N, SI:N, SA:N): No direct impact on subsequent systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
