CVE-2019-1385

What is Windows AppX Deployment Service?

AppX Deployment Service (AppXSVC) is the Windows component responsible for installing, updating, and removing Universal Windows Platform (UWP) apps distributed as .appx/.msix packages, including those from the Microsoft Store. Because package installation routinely runs with elevated (SYSTEM) privileges to write into protected areas of the file system and registry, any flaw in how it manages temporary files or symbolic links during deployment can be abused by a low-privileged local user to gain SYSTEM-level access.

Overview

CVE-2019-1385 is a local privilege escalation vulnerability in the Windows AppX Deployment Extensions. The service does not properly manage privileges when handling objects during package deployment, allowing a local attacker who can plant or redirect a file (via a hard link/junction) to have SYSTEM-privileged operations act on an unintended, attacker-controlled file. The result is arbitrary file overwrite or execution in an elevated context, leading to full local privilege escalation. Microsoft rated it Important with a CVSS 3.1 base score of 7.8.

Technical Details

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access, i.e. "link following"). AppXSVC performs file operations as SYSTEM during package installation without adequately verifying that the target of a link matches the expected object. A local, low-privileged attacker can create a hard link or reparse point pointing at a sensitive file, then trigger the AppX deployment flow so that the SYSTEM-privileged service follows the link and operates on the attacker's target instead of the intended package file — a classic TOCTOU-style link-following privilege escalation. Exploitation requires local code execution but no user interaction and low attack complexity, which is why it carries a High severity rating despite the local attack vector.

Discovery

The vulnerability was addressed by Microsoft as part of routine internal security review and disclosed through the November 2019 Patch Tuesday release; no external researcher credit is listed in Microsoft's advisory.

Exploitation Context

Its presence on the CISA KEV catalog (added May 2022) confirms it has been observed used in real-world attacks, and CISA flags it as having been used in ransomware campaigns. Local privilege escalation bugs like this are commonly chained by attackers who already have initial (low-privileged) code execution — for example via phishing or a separate remote exploit — to escalate to SYSTEM and deploy ransomware payloads or disable security tooling.

Remediation

1. Apply the November 2019 Windows cumulative update (or later) that addresses CVE-2019-1385; this is included in all subsequent Windows security rollups.
2. Verify patch status across the fleet using Windows Update compliance reporting or a vulnerability scanner that checks the relevant KB.
3. Restrict local logon rights and standard-user privileges where feasible to reduce the pool of accounts that could stage a local exploit.
4. Monitor for anomalous AppX/AppXSVC activity and unexpected SYSTEM-owned file modifications in EDR telemetry.
5. Treat this patch as a priority on endpoints where ransomware operators are known to seek local privilege escalation post-compromise.