CVE-2019-1130

Windows AppX Deployment Service fails to properly handle hard links, allowing an attacker with local access to gain higher system privileges. This is a serious flaw because it lets ordinary users escalate their permissions to administrator level.

The vulnerability exists in AppXSVC's hard link handling mechanism (CWE-59: Improper Link Resolution Before File Access), exploitable via local access with minimal privileges. An attacker can manipulate hard links to bypass access controls during file operations, achieving privilege escalation to SYSTEM or administrator context. Successful exploitation requires local code execution capability and knowledge of the vulnerable code path.