CVE-2019-1064

What is AppXSVC?

The AppX Deployment Service (AppXSVC) is the privileged Windows component responsible for installing, updating, and removing Universal Windows Platform (UWP) apps from the Microsoft Store. It runs as SYSTEM and manipulates filesystem permissions on behalf of standard users during app installation, which makes any flaw in its file-handling logic a direct route from a low-privileged account to full system control.

Overview

CVE-2019-1064 is a High-severity local privilege-escalation vulnerability that is, in effect, the sequel to CVE-2019-0841: after Microsoft's April 2019 fix for the AppXSVC hard-link abuse bug, a public bypass surfaced showing the fix was incomplete, and Microsoft shipped this hardened follow-up patch. As before, the underlying issue is improper link resolution before file access (CWE-59): AppXSVC can be tricked, via a hard link substituted after a permission check but before the operation completes, into granting a local attacker write access to files it should not touch.

Technical Details

The vulnerability follows the same time-of-check-to-time-of-use (TOCTOU) pattern as its predecessor: a local, low-privileged attacker races AppXSVC's permission-setting logic during app installation, replacing the target path with a hard link to a protected system file. No user interaction is required, and successful exploitation grants read/write control over arbitrary protected files, which attackers can trivially escalate to full SYSTEM code execution by overwriting a file loaded by a privileged process.

Discovery

The hard-link abuse technique against Windows Installer/AppX components — and the subsequent bypass of Microsoft's initial fix that necessitated this patch — was demonstrated through public proof-of-concept research by the pseudonymous security researcher SandboxEscaper, part of a broader series of Windows local privilege-escalation disclosures and patch bypasses she published throughout 2018 and 2019.

Exploitation Context

CISA's KEV catalog confirms real-world exploitation and notes this vulnerability's use in ransomware operations. Because the underlying bug class had already been publicized in connection with CVE-2019-0841 before this hardened fix shipped, it represents a case where an incomplete initial patch left a real-world exploitation window open even after "remediation," underscoring the value of confirming the specific fixed build rather than assuming an earlier patch was sufficient.

Remediation

1. Apply the June 2019 Patch Tuesday cumulative update (or any later update), which contains the hardened fix — confirm this specific patch level rather than relying on the earlier April 2019 update alone.
2. Treat this as a high-priority patch given its confirmed use in ransomware intrusions.
3. Restrict standard users' ability to install UWP applications where not operationally necessary.
4. Deploy endpoint monitoring for suspicious hard-link creation targeting system directories.
5. Audit systems that were unpatched during the exposure window for signs of privilege-escalation activity or unauthorized file modification.