A missing authorization check in the Windows AppX Deployment Service permits an authorized user to tamper with the system locally. The flaw allows modification of privileged service configurations or files that the service manages, potentially enabling installation of malicious packages or altering application behavior, thereby compromising integrity and availability of applications.

The vulnerability affects several Windows products. Microsoft Windows 10 releases 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, a 26H1 update for 26H2, and the ARM64‑based 26H2 edition; as well as server editions Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The flaw carries a CVSS score of 5.5, indicating moderate severity. No EPSS score is available, but the lack of public exploitation references suggests a moderate likelihood of exploitation in environments where the AppX Deployment Service is enabled and local users have sufficient permissions. The vulnerability is listed in neither Microsoft’s catalog of known exploited vulnerabilities nor CISA’s KEV database, meaning no confirmed exploitation has been reported. Attackers need local authorization and the ability to run processes on the target machine to leverage the flaw, which also limits the overall scope to users who already possess legitimate access.