Improper link resolution before file access in the Windows AppX Deployment Service allows an authorized local attacker to execute code with elevated privileges, compromising system integrity and enabling further attacks. The flaw is based on CWE-59, where an attacker can use malicious shortcuts or links to gain administrative rights. With elevated privileges, the attacker may modify system files, install malware, or alter security settings, threatening confidentiality, integrity, and availability.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 (including the arm64-based 26H2 release); and Microsoft Windows Server releases 2016 (including Server Core), 2019 (including Server Core), 2022, and 2025 (including Server Core).

The CVSS score of 7.8 categorizes this flaw as high severity, but the EPSS score is not available, so no publicly reported exploitation probability exists, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local; based on the description, an authorized user who can invoke the Windows AppX Deployment Service may create a malicious link that follows the service’s resolution logic before file access, thereby enabling privilege escalation and administrative control. Security teams should consider the possibility of automated exploitation in environments where app deployment is frequent and must treat this as a critical patching priority.