{"id":"CVE-2019-1064","published":"2019-06-12T14:29:04Z","modified":"2026-06-17T02:27:44Z","title":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data.\nTo exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.\nThe security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.","provenance":"source","from":"NVD"},"summary":{"text":"A local elevation of privilege flaw exists in the Windows AppX Deployment Service (AppXSVC) because it improperly handles hard links. An attacker who has already logged on to the system can run a specially crafted application to exploit it, gaining an elevated execution context from which they could install programs and view, change, or delete data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:09Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.06886,"percentile":0.94071,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1064","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-15","exploitedFirstSeen":"2022-03-15","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-15"},{"url":"https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates","date":"2022-03-24"},{"url":"https://www.securin.io/articles/all-about-conti-ransomware/","date":"2022-06-29"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1064","tags":["Patch","Vendor Advisory"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1064","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1064","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: requires prior valid local logon","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"an attacker would first have to log on to the system","start":328,"end":380}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: hard link flaw yields elevated process execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"An attacker who successfully exploited this vulnerability could run processes in an elevated context","start":125,"end":225}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-9646","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9646","exploited":true,"exploitedSince":"2022-03-15","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2019-06-12","earliestUrl":"https://github.com/RythmStick/CVE-2019-1064","repos":[{"name":"RythmStick/CVE-2019-1064","url":"https://github.com/RythmStick/CVE-2019-1064","stars":26,"created":"2019-06-12"},{"name":"0x00-0x00/CVE-2019-1064","url":"https://github.com/0x00-0x00/CVE-2019-1064","stars":11,"created":"2019-06-12"},{"name":"attackgithub/CVE-2019-1064","url":"https://github.com/attackgithub/CVE-2019-1064","stars":1,"created":"2019-06-16"}]},"first":{"date":"2019-06-12","source":"PoC-in-GitHub","url":"https://github.com/RythmStick/CVE-2019-1064"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1068"],"provenance":"ai"}],"timeline":[{"date":"2019-06-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1064","provenance":"source"},{"date":"2019-06-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/RythmStick/CVE-2019-1064","provenance":"source"},{"date":"2022-03-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2022-03-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9646","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1007},"priority":{"score":74.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1692 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":18.81,"detail":"percentile 0.9407"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-59"}}