CVE-2026-7574

The record

Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.0, v1.1617.0, and v1.2278.0) validates only file presence and a version marker string before booting rootfs.img, but does not verify image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim macOS user can modify the VM root filesystem image and have it trusted on subsequent Cowork VM boots, enabling persistent arbitrary code execution in the VM and access to host-mounted directories. The estimated CWE mapping is CWE-353 (Missing Support for Integrity Check).

Affected packages

Related vulnerabilities

• CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing… CWE-353
• CVE-2026-58224 A flaw was found in Samba's CTDB, the clustered database service used by Samba. CWE-353
• CVE-2026-17583 The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because… CWE-353
• CVE-2026-48995 pnpm is a package manager. CWE-353
• CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. CWE-353
• GHSA-g29v-q6h7-76wh electerm's encrypt method not safe enough CWE-353
• CVE-2026-42428 OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded… CWE-353
• CVE-2026-33261 A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a… CWE-353