CVE-2026-88224

EUVD-2026-121534
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Windows Releases
Platform
Version
Windows 10
1607 (x64, x86)
KB5131291
1809 (x64, x86)
KB5131085
Windows Server 2016
Server Core
KB5131291
Standard
KB5131291
Windows Server 2019
Server Core
KB5131085
Standard
KB5131085
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88224