CVE-2019-1129
Published: 15 July 2019
Summary
CVE-2019-1129 is a high-severity Link Following (CWE-59) vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
An elevation of privilege vulnerability exists in the Windows AppX Deployment Service (AppXSVC) due to improper handling of hard links. The flaw is tracked under CWE-59 and carries a CVSS 3.1 base score of 7.8, reflecting local attack vector, low attack complexity, and low privileges required for exploitation. It affects Windows systems that use the AppX deployment mechanism and is distinct from the related CVE-2019-1130.
A local attacker with a low-privileged account can exploit the issue to obtain elevated privileges on the affected system, resulting in full control over confidentiality, integrity, and availability of the host. The attack requires no user interaction and can be performed from a standard user context.
Microsoft published remediation guidance in its security advisory for CVE-2019-1129. The vulnerability appears in CISA's catalog of known exploited vulnerabilities, confirming observed in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9706
Vulnerability details
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
- CWE(s)
- KEV Date Added
- 15 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the elevation from low-privileged accounts by ensuring AppXSVC and related processes cannot grant unauthorized higher rights via hard-link abuse.
Enforces access-control decisions on file operations inside AppXSVC, blocking the improper link-resolution path that allows privilege escalation.
Requires prompt application of the vendor patch that corrects the hard-link handling flaw in AppXSVC before exploitation can succeed.