CVE-2019-1130

What is the AppX Deployment Service?

The AppX Deployment Service (AppXSVC) is the SYSTEM-privileged Windows component that installs, updates, and removes packaged AppX/MSIX applications, including Microsoft Store apps. Because it performs privileged file operations at the request of unprivileged users during app install/uninstall, weaknesses in how it validates file paths translate directly into a path from standard user to SYSTEM.

Overview

CVE-2019-1130 is a privilege escalation vulnerability in AppXSVC, patched in the same July 2019 update cycle as the closely related CVE-2019-1129. It stems from improper hard-link handling during package deployment file operations, allowing a local, low-privileged attacker to trick the SYSTEM-level service into performing a file operation against an attacker-chosen target instead of the intended temporary file.

Technical Details

As with other AppXSVC issues from this period, the root cause is CWE-59 (improper link resolution before file access): the service checks a file path for validity and then later performs a privileged operation on that path without re-verifying it hasn't been replaced with a hard link pointing at a protected system file. A local attacker who wins this time-of-check/time-of-use race can cause SYSTEM to overwrite or manipulate a file it shouldn't touch, escalating from a standard user context to SYSTEM. The attack requires local access and low privileges, no user interaction, and Low attack complexity — it is a reliable, well-understood exploitation pattern rather than a novel memory-corruption bug.

Discovery

Microsoft addressed this alongside several other AppX/servicing-related hard-link bugs disclosed and fixed throughout mid-to-late 2019; no specific outside researcher is publicly credited for this individual CVE in Microsoft's advisory.

Exploitation Context

Its presence in the CISA KEV catalog confirms confirmed real-world exploitation, and the ransomwareUse: true flag indicates this bug has been observed used by ransomware operators as a local privilege-escalation step after gaining an initial low-privileged foothold on a Windows host — a standard pattern for turning a phishing or web-shell compromise into full administrative control before deploying ransomware payloads.

Remediation

1. Apply the July 2019 (or later) Windows cumulative update, which fixes AppXSVC's hard-link validation logic.
2. Prioritize patching across all endpoints — exploitation only requires local code execution, which is commonly achieved through unrelated initial-access vectors.
3. Limit interactive logon rights and standard-user software installation privileges where feasible to reduce the attack surface for local LPE chains.
4. Deploy EDR capable of detecting suspicious hard-link creation or file-system race conditions targeting privileged services.
5. Audit for unexpected SYSTEM-context file modifications tied to AppX package install/removal events on unpatched hosts.