Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use

published 2026-06-23 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-38639

cvss: 8.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits: 0; none known

Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim macOS user can modify the VM root filesystem image and have it trusted on subsequent Cowork VM boots, enabling persistent arbitrary code execution in the VM and access to host-mounted directories. The estimated CWE mapping is CWE-353 (Missing Support for Integrity Check).

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-06-24)

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.7	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected products

Anthropic Claude Desktop Cowork

Classification

Weakness

CWE-353 Missing Support for Integrity Check

References

cfp.recon.cx /recon-2026/talk/DZUQYU/
related
takeonme.org /gcves/GCVE-1337-2026-0000000000000000000000000000000000000000000000000111011111110101111111111000000000000000
third-party-advisory

Sources

CVE List CVE-2026-7574
NVD CVE-2026-7574

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary