CVE-2019-1130

An elevation of privilege vulnerability exists in the Windows AppX Deployment Service (AppXSVC), which improperly handles hard links when working with deployed app packages (CWE-59, link following). A local attacker with limited user privileges can exploit the mishandled hard-link handling to execute code with elevated rights, gaining high-impact confidentiality, integrity, and availability control over the host. Affected systems are Windows 10 versions 1507 through 1903, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 1803, and Windows Server 1903. The flaw is exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23 with known ransomware use, and EPSS estimates a 2.3% probability of exploitation within the next 30 days. No public proof-of-concept is known; attackers appear to use working exploits not publicly released.

What to do: Apply Microsoft's security updates for the affected Windows versions per vendor instructions (the fixes shipped in the July 2019 Patch Tuesday updates), or upgrade hosts beyond Windows 10 1507–1903/Server 2012-era builds. Prioritize patching workstations and servers in ransomware-exposed environments, since this flaw is listed in CISA's KEV with known ransomware use and is typically chained with other vulnerabilities to escalate from an initial foothold to SYSTEM. Confirm remediation by verifying hosts no longer run unpatched instances of the affected builds.