Windows Biometric Service CVE-2026-69489

Exploitation requires a valid, low-privileged local Windows session - an attacker must be able to log in or execute code as a standard user on the target system. The Windows Biometric Service (WbioSrvc) must be running; it starts automatically on Windows installations with biometric hardware detected, and may also run on systems without hardware if configured. No network access is required; exploitation is strictly local. Factors limiting exploitation: the attacker cannot be unauthenticated or purely remote without a separate initial-access vulnerability; no user interaction from a higher-privileged user is needed, but the attacker must have their own active session. Server Core installations are affected but typically have a smaller local-user attack surface due to restricted interactive login policies.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8, which accurately reflects the threat model: exploitation is local-only (AV:L) and requires an existing low-privileged account (PR:L), meaning remote or unauthenticated attackers are excluded without a secondary foothold. Attack complexity is Low (AC:L) and no user interaction is needed (UI:N), so once a local session exists the exploit path is reliable with no social engineering required. Full CIA impact (C:H/I:H/A:H) reflects SYSTEM-level privilege gain. No EPSS data was provided; no CISA KEV listing and no public POC are known at time of analysis, which limits the immediate automated-exploitation risk. In practice, this is a high-value local-privilege-escalation primitive: commodity malware, ransomware, and post-exploitation frameworks routinely chain LPE vulnerabilities after initial access to achieve SYSTEM, making this a genuine remediation priority for enterprise environments despite its non-critical CVSS score.

An attacker who has obtained a standard Windows user account - via phishing, credential theft, or initial malware execution - invokes Windows Biometric Framework API calls targeting WinBioSvc with a crafted malformed payload. The payload triggers the heap buffer overflow, corrupting adjacent heap structures or function pointers within the privileged service process, and the attacker redirects execution to shellcode or a ROP chain, achieving SYSTEM privileges. No public POC is known at time of analysis, but the AC:L rating indicates the overflow condition is straightforwardly reproducible.