Windows Biometric Service CVE-2026-69298

Exploitation requires an active, authenticated local logon session on the target Windows machine - either a physical console session or a remote desktop (RDP) session. The attacker must hold at minimum a standard (low-privileged) user account; no administrative rights are required. The Windows Biometric Service (WbioSrvc) must be running, which is the default state on all consumer and most enterprise Windows installations that support Windows Hello. No specific biometric hardware needs to be present or functional - the service can be triggered independently of physical sensors. Exploitation is limited to local-only vectors (AV:L); the vulnerability is not remotely exploitable over a network without first obtaining local code execution through another means.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects local, low-complexity exploitation requiring only a low-privileged account - no user interaction or elevated rights needed beyond a basic logon session. The attack complexity is low, meaning no race conditions or advanced heap grooming are required per the scoring. No KEV listing and no public POC exist at time of analysis, so EPSS-equivalent real-world exploitation pressure is currently low; however, the breadth of affected Windows releases (all major versions from 2016 to present) means the addressable attack surface is enormous. The privileged target process (SYSTEM) makes this a valuable post-access escalation step in multi-stage intrusions. Even a small IT organization should treat this as a high-priority patch given how straightforwardly any authenticated local or RDP session user can weaponize it.

An attacker who has gained a low-privileged local shell - via phishing, a web-browser sandbox escape, or RDP access with a standard domain account - calls into the Windows Biometric Service with a crafted request designed to trigger the integer overflow. The resulting undersized buffer allocation is overwritten, corrupting memory in the SYSTEM-context service process. No public POC exists at time of analysis, but the low attack complexity rating indicates the overflow primitive is reliably triggerable without sophisticated heap manipulation.