How to Fix CVE-2019-0841: Improper Link Resolution Before File Access in Microsoft Windows

Actively exploited. Listed in the CISA Known Exploited Vulnerabilities catalog since 2022-03-15; federal civilian agencies had to remediate by 2022-04-05. This is a local privilege-escalation flaw: an attacker needs to already be running code as a low-privileged user on the box. It pairs with phishing or browser exploits to turn a foothold into SYSTEM, so any multi-user or internet-facing host should be patched on an emergency cycle.

What is CVE-2019-0841?

CVE-2019-0841 is a local elevation-of-privilege vulnerability in the Windows AppX Deployment Service (AppXSVC), the service that installs, updates and removes Universal Windows Platform (UWP/Store) apps. AppXSVC runs as NT AUTHORITY\SYSTEM and, as part of managing per-package files under directories such as %ProgramData%\Microsoft\Windows\AppRepository, it changes ownership and access-control lists (ACLs) on files it believes belong to the package being installed.

The bug is a classic link-following flaw (CWE-59). The service does not properly validate hard links before it acts on a target file. A low-privileged user can plant a hard link that points from a file AppXSVC is about to operate on to a sensitive system file the user could not normally touch, for example, a DLL or configuration file owned by SYSTEM. When the service runs, it follows the link and rewrites the ACL of the target, handing the attacker full control of a file they should never have been able to modify. From there the attacker overwrites a SYSTEM-executed binary or DLL and gains code execution as SYSTEM.

This is a local privilege escalation, not remote code execution. The CVSS vector confirms it: AV:L (local access required), PR:L (the attacker must already hold low privileges), and UI:N. The reward is high across the board. confidentiality, integrity and availability impacts are all rated HIGH because SYSTEM is the top of the Windows trust model. Microsoft notes this CVE is distinct from the sibling April 2019 AppX/EoP issues CVE-2019-0730, 0731, 0796, 0805 and 0836, which were fixed in the same monthly update.

The flaw matters because it is the second half of a real attack chain. Browser exploits, malicious documents and commodity malware routinely land as a normal user. CVE-2019-0841 is exactly the kind of "get to SYSTEM" step that turns that foothold into full host compromise, which is why CISA placed it on the KEV list and why public PoCs (Exploit-DB 46683, ZDI-19-360) circulate widely.

Am I affected?

You are affected if the host runs an unpatched build of Windows 10 1703, 1709, 1803 or 1809, or Windows Server 1709 (Core), 1803 (Core), or Windows Server 2019, and the AppX Deployment Service is present (it ships on all of these by default). The fix is the cumulative security update Microsoft released on 9 April 2019; any system that has installed a cumulative update from April 2019 or later is already protected.

Check the build and whether the April 2019 (or later) update is present with PowerShell:

# Show OS build (e.g. 17763.x = 1809, 17134.x = 1803, 16299.x = 1709, 15063.x = 1703)
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').ReleaseId

# Is the AppX Deployment Service present? (the affected component)
Get-Service AppXSvc | Format-List Name,Status,StartType

# List installed cumulative updates, newest first.
# A KB installed on/after 2019-04-09 covers CVE-2019-0841.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object HotFixID,InstalledOn -First 15

The authoritative affected-build matrix and the exact KB per build live in the MSRC advisory. Note that every build listed above is long past end of mainstream and security support; if a host is still on Windows 10 1809 or Server 1709/1803 today, the right move is to bring it onto a supported release, not just to apply one 2019 patch.

How to fix CVE-2019-0841

There is no special hotfix to chase and no standalone "fixed version number" to install. The correction shipped inside the 9 April 2019 Patch Tuesday cumulative update for each affected Windows build. Install that update (or any later cumulative update, which is cumulative and therefore includes it) and reboot. These are all Windows-only steps, this vulnerability does not exist on Linux, so there is nothing to do with apt, dnf or any package manager.

Apply the cumulative update (recommended)

On a normally managed host, just let Windows Update or your WSUS/Intune/SCCM ring install the latest cumulative update. To trigger and install it on demand with PowerShell run as administrator:

# Option A: PSWindowsUpdate module
Install-Module PSWindowsUpdate -Force -Scope CurrentUser -ErrorAction SilentlyContinue
Import-Module PSWindowsUpdate
Get-WindowsUpdate -Install -AcceptAll -AutoReboot -Category 'Security Updates'

# Option B: built-in scan/download/install with no extra module
(New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList 'StartScan'
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList 'StartDownload'
Start-Process "$env:windir\System32\UsoClient.exe" -ArgumentList 'StartInstall'

Manual install from the Microsoft Update Catalog

For an isolated or air-gapped host, download the correct cumulative update .msu for your exact build from the Microsoft Update Catalog and install it with wusa.exe. Match the KB to your build from the MSRC advisory: for example, the April 2019 update for 1809 was KB4493509, for 1803 KB4493464, and for 1709 KB4493441.

# Search the catalog for your build's update, e.g. KB4493509 for Windows 10 1809 x64
# https://www.catalog.update.microsoft.com/Search.aspx?q=KB4493509
$msu = "$env:USERPROFILE\Downloads\windows10.0-kb4493509-x64.msu"
Start-Process wusa.exe -ArgumentList "`"$msu`" /quiet /norestart" -Wait
shutdown.exe /r /t 60 /c "Reboot to finalise the CVE-2019-0841 security update"

Across a fleet (WSUS / SCCM / Intune)

If you manage many hosts, do not script wusa everywhere. Approve the relevant monthly cumulative update in WSUS or deploy it as an update ring in Intune/SCCM, then track compliance from the management console. Because Windows quality updates are cumulative, approving the current month's update remediates CVE-2019-0841 and every later fix in a single deployment.

If you can't patch immediately

There is no supported configuration change that disables the bug while keeping AppXSVC working, so the only real fix is the update. Because this is a local EoP, the meaningful interim controls are about limiting who can run code on the box and watching the host:

• Remove unnecessary interactive and RDP logon rights so fewer accounts can reach the local attack surface. On servers, restrict Allow log on locally and Allow log on through Remote Desktop Services to administrators only.
• Apply least privilege: users who do not need to install Store apps gain nothing from leaving broad access in place. Enforce standard-user (non-admin) accounts for daily work.
• Turn on tamper-resistant EDR / Microsoft Defender for Endpoint so the post-exploitation step (overwriting a SYSTEM binary, spawning a SYSTEM process from AppXSvc) is detected.
• Stop and disable AppXSvc only if you can prove Store-app management is never used on that host; this breaks UWP install/update and is not a general workaround. Re-enable it before patching.

How to verify the fix worked

1. Confirm the cumulative update is present: Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5. The newest HotFixID should be the April 2019 KB for your build (or a later month's KB).
2. Confirm the OS build number moved to or past the patched revision for your branch as listed in the MSRC advisory (for 1809, build 17763.437 or higher carries the April 2019 fix).
3. Re-run an authenticated vulnerability scan (Nessus, Qualys, OpenVAS, or Microsoft Defender Vulnerability Management) against the host. CVE-2019-0841 must no longer be reported.
4. Review Defender/EDR and Windows event logs for prior AppXSvc abuse, unexpected ACL changes on SYSTEM-owned files, or SYSTEM processes spawned from svchost hosting AppXSvc before the patch date. Treat any pre-patch hit as a possible compromise: isolate, rotate exposed credentials, and run full IR triage.

Is CVE-2019-0841 remote code execution?

No. It is a local elevation-of-privilege flaw in the AppX Deployment Service (AppXSVC). The attacker must already be able to run code as a low-privileged user on the machine (CVSS vector AV:L, PR:L). It cannot be triggered over the network on its own; it is used as the privilege-escalation stage after an initial foothold from phishing, a malicious document, or a browser exploit.

Which Windows update fixes CVE-2019-0841?

The Microsoft cumulative security update from Patch Tuesday, 9 April 2019. There is no separate fixed "version". the patch is inside the monthly cumulative update for each build (for example KB4493509 for Windows 10 1809, KB4493464 for 1803, KB4493441 for 1709). Any later cumulative update also includes the fix. Look up the exact KB for your build in the MSRC advisory.

Is CVE-2019-0841 actively exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-03-15, with a federal remediation deadline of 2022-04-05 under BOD 22-01. Public proof-of-concept exploits exist, including Exploit-DB 46683 and Zero Day Initiative advisory ZDI-19-360, so weaponization is trivial for an attacker who already has a local foothold.

Can I just disable AppXSvc instead of patching?

Not as a real fix. Stopping the AppX Deployment Service breaks installation and updates of Store/UWP apps and is only viable on hosts that never manage those apps. It also has to be re-enabled before the cumulative update can install cleanly. Patch the host; do not rely on disabling the service as a long-term control.

References

• Official vendor advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0841
• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2019-0841
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.exploit-db.com/exploits/46683/
• http://packetstormsecurity.com/files/152463/Microsoft-Windows-AppX-Deployment-Service-Privilege-Escalation.html
• https://www.zerodayinitiative.com/advisories/ZDI-19-360/
• http://packetstormsecurity.com/files/153009/Internet-Explorer-JavaScript-Privilege-Escalation.html

This guide was assembled from the official vendor advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the vendor advisory before applying changes in production.

Related fixes

Other flaws in this area worth reviewing while you patch this one:

• How to Fix CVE-2019-1405: Improper Privilege Management in Microsoft Windows
• How to Fix CVE-2019-1069: Improper Link Resolution Before File Access in Microsoft Task Scheduler
• How to Fix CVE-2019-1132: Elevation of Privilege in Microsoft Win32k
• How to Fix CVE-2019-0903: Remote Code Execution in Microsoft Graphics Device Interface (GDI)
• How to Fix CVE-2019-0541: Remote Code Execution in Microsoft Office