CVE-2019-0841

What is AppXSVC?

The AppX Deployment Service (AppXSVC) is the privileged Windows component responsible for installing, updating, and removing Universal Windows Platform (UWP) apps from the Microsoft Store. Because it runs as SYSTEM and manipulates files and permissions on behalf of standard users during app installation, any flaw in how it handles filesystem operations is a direct path from a low-privileged account to full system control.

Overview

CVE-2019-0841 is a High-severity privilege escalation vulnerability caused by improper link resolution before file access (CWE-59, "link following") in AppXSVC. During app installation, AppXSVC modifies permissions on a folder inside the user's profile without properly checking whether that path is a hard link; a local attacker could replace the folder with a hard link to a protected system file (such as a DLL loaded by a privileged process) and have AppXSVC grant it world-writable permissions, effectively handing the attacker write access to any file on the system. Microsoft's initial April 2019 patch was subsequently found to be incomplete: a public bypass was disclosed within weeks, and Microsoft shipped a follow-up fix as CVE-2019-1064.

Technical Details

The vulnerability is a classic time-of-check-to-time-of-use (TOCTOU) race combined with hard-link abuse: AppXSVC operates on a path under attacker control without validating that it still refers to the same object by the time permissions are applied. Exploitation requires local access and low privileges but no user interaction, and grants full read/write control over otherwise-protected files, which is trivially escalated into full SYSTEM code execution (for example, by overwriting a DLL loaded by a privileged service).

Discovery

The underlying hard-link permission-abuse technique against Windows Installer/AppX components was popularized through public proof-of-concept research and disclosures by the pseudonymous security researcher SandboxEscaper, who published a series of unpatched Windows local privilege-escalation bugs and bypasses throughout 2018 and 2019, including bypasses of Microsoft's initial fixes in this family of bugs.

Exploitation Context

CISA's KEV catalog confirms real-world exploitation, and notes this vulnerability has been used in ransomware operations — a natural fit, since ransomware affiliates commonly need a fast, reliable local privilege-escalation primitive after gaining an initial low-privileged foothold via phishing or a compromised account, in order to disable security tooling and spread across a network with administrative rights.

Remediation

1. Apply both the April 2019 patch and the subsequent May 2019 follow-up fix (CVE-2019-1064) — the first patch alone was incomplete.
2. Verify patch level directly rather than assuming a single update cycle resolved the issue, given the documented bypass.
3. Restrict the ability of standard users to install UWP applications where not operationally necessary.
4. Deploy endpoint monitoring for suspicious hard-link creation targeting system directories or files.
5. Treat this as a high-priority patch on any host reachable by low-privileged or shared accounts, given its confirmed ransomware use.