CVE-2025-48820 Overview
CVE-2025-48820 is a local privilege escalation vulnerability in the Windows AppX Deployment Service. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authorized local attacker can abuse symbolic or hard links to redirect privileged file operations performed by the service. Successful exploitation allows the attacker to elevate privileges on the local system.
The vulnerability affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2016 through Windows Server 2025. Microsoft addressed the issue through its Security Update Guide.
Critical Impact
A low-privileged local user can gain SYSTEM-level access by manipulating file system links processed by the AppX Deployment Service.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-07-08 - CVE-2025-48820 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-48820
Vulnerability Analysis
The Windows AppX Deployment Service (AppXSvc) runs with elevated privileges to install, update, and manage packaged applications. During deployment operations, the service accesses files and directories on behalf of the calling user. The vulnerability arises because the service resolves file paths without adequately validating whether those paths pass through attacker-controlled links.
By planting a symbolic link, junction, or hard link that a low-privileged user can create in a writable location, an attacker redirects a privileged file operation to a target outside their permission boundary. The service then reads, writes, or replaces a file using its own SYSTEM-level access token. This produces a full local privilege escalation from a standard user context.
Root Cause
The root cause is a link-following defect in the AppX Deployment Service, tracked as [CWE-59]: Improper Link Resolution Before File Access. The service does not open files with sufficient reparse-point handling or use file handles that reject symlink traversal. As a result, path canonicalization occurs after the trust boundary is crossed.
Attack Vector
Exploitation requires local access and low privileges, with no user interaction. An attacker prepares a directory containing crafted links pointing to a protected file, then triggers an AppX deployment operation that touches that location. When the service performs the file operation, it follows the attacker's link and modifies the target with elevated rights. No verified public exploit is available at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified code examples are available. See the Microsoft Security Update CVE-2025-48820 advisory for vendor-specific technical details.
Detection Methods for CVE-2025-48820
Indicators of Compromise
- Creation of symbolic links, junctions, or hard links in user-writable directories that reference paths under %ProgramFiles%\WindowsApps, %SystemRoot%\System32, or other SYSTEM-owned locations.
- Unexpected file writes to protected directories with AppXSvc or svchost.exe hosting AppXSvc as the acting process.
- Standard user accounts invoking AppX deployment APIs such as Add-AppxPackage shortly before privilege gain.
Detection Strategies
- Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for AppXSvc file operations that resolve outside the caller's profile.
- Enable object access auditing on sensitive directories to flag writes performed by the AppX Deployment Service on behalf of non-admin users.
- Correlate AppX package installation events (Microsoft-Windows-AppXDeploymentServer/Operational) with subsequent token elevation or new local admin activity.
Monitoring Recommendations
- Alert on reparse point creation by non-administrative users in staging paths later accessed by SYSTEM processes.
- Track anomalous invocations of Add-AppxPackage, Add-AppxProvisionedPackage, and related deployment cmdlets from standard user sessions.
- Baseline expected AppX deployment activity per host and flag deviations that coincide with privilege changes.
How to Mitigate CVE-2025-48820
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-48820 advisory to all affected Windows client and server builds.
- Prioritize patching multi-user systems, terminal servers, and jump hosts where local attackers are most likely to gain a foothold.
- Audit local accounts and remove unnecessary interactive logon rights on servers.
Patch Information
Microsoft has issued cumulative updates addressing CVE-2025-48820 for all supported Windows 10, Windows 11, and Windows Server releases listed in the advisory. Consult the vendor advisory for the specific KB article that matches each build number, and validate patch deployment through Windows Update for Business, WSUS, or your preferred patch management workflow.
Workarounds
- Restrict the ability of standard users to create symbolic links by leaving the SeCreateSymbolicLinkPrivilege assigned only to administrators.
- Disable or restrict sideloading of AppX packages on systems that do not require user-driven application deployment.
- Where patching is delayed, monitor for reparse point creation and AppX deployment activity from non-administrative users as a compensating control.
# Verify only Administrators hold SeCreateSymbolicLinkPrivilege
whoami /priv
secedit /export /cfg C:\Temp\secpol.cfg
findstr /I "SeCreateSymbolicLinkPrivilege" C:\Temp\secpol.cfg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
