Windows Biometric Service CVE-2026-69323

The attacker must hold a valid local interactive or remote desktop session on the target Windows host with at minimum standard (low-privileged) user rights - reflected in CVSS PR:L. The Windows Biometric Service (wbiosrvc) must be running; it is started on-demand by default on Windows 10/11 when biometric hardware is present and may also be running on systems without hardware if previously triggered. No user interaction is required beyond the attacker's own API calls to the service. Exploitation is limited to systems where the attacker already has local code execution, meaning this cannot be used as an initial-access vector - it is a privilege escalation step. Server Core installations are equally affected, as the service is present regardless of GUI components.

The CVSS 7.8 score accurately reflects a local privilege escalation with low attack complexity. The PR:L requirement means the attacker must already hold a foothold on the system - this is not a remote initial-access vector but rather a highly effective privilege escalation step. AC:L indicates the overflow is reliably triggerable without race conditions or precise heap-grooming. LPE primitives targeting high-privileged Windows services are a staple of post-exploitation toolkits and ransomware deployment chains; even without a current KEV or public POC, the broad Windows footprint (15 distinct OS/Server build lines patched) and reliable exploitation conditions elevate real-world priority above what the 7.8 score alone suggests. No EPSS score was provided in the input; exploitation probability is therefore unquantified but operationally meaningful given Windows's ubiquitous enterprise presence. The absence of KEV listing and public POC does reduce immediate urgency compared to actively weaponized LPEs, but the broad patch scope suggests Microsoft treats this as a credible risk.

An attacker who has gained a foothold on a Windows endpoint via phishing or credential theft - operating as a standard domain user - sends a malformed biometric API request to Windows Biometric Service, triggering the heap overflow and corrupting internal service state. Successful exploitation elevates the attacker's session to SYSTEM, enabling credential dumping via LSASS, disabling endpoint security tools, or deploying ransomware payloads. No public POC is currently known, but the low-complexity trigger condition makes this achievable for skilled post-exploitation operators.