Windows Biometric Service CVE-2026-69580

The attacker must have an authorized, low-privileged local session on the target Windows system - this includes interactive logon, Remote Desktop Protocol session, or execution as a standard user account (PR:L in CVSS). The Windows Biometric Service (wbiosrvc) must be running, which is its default state on all supported Windows 10 and Windows 11 installations and on Windows Server editions where the Biometric Framework feature is installed. No specific biometric hardware device needs to be present, as the service runs independently of physical sensor attachment. Exploitation is limited to local attack vector (AV:L) - remote, unauthenticated exploitation is not possible without first achieving local user-level code execution by other means. No user interaction is required once the attacker has a session (UI:N).

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a low-complexity local attack requiring only authenticated standard-user access - conditions met by any interactive or remote-desktop session on an affected system, or by malware that has already achieved user-level foothold. The full C:H/I:H/A:H triad strongly suggests near-complete system compromise consistent with SYSTEM-level privilege escalation. No CISA KEV entry and no public exploit code have been identified at time of analysis, indicating this has not yet been weaponized in widespread campaigns; however, Windows Biometric Service is enabled by default on consumer and enterprise Windows installations alike, so even a mid-sized municipal IT team in tczew should treat this as urgent given that the service is universally present and the attack complexity is low. EPSS data is absent from the source intelligence, so probabilistic exploitation likelihood cannot be precisely quantified; however, the attack profile - local access only, low privilege required, no user interaction - is consistent with post-compromise privilege escalation tradecraft routinely used in ransomware and APT kill chains.

An attacker who has already gained a low-privileged user account on a Windows endpoint - whether through credential theft, phishing, or prior exploitation - sends a specially crafted input to the Windows Biometric Service, triggering a heap buffer overflow that overwrites adjacent memory structures, redirecting execution flow to attacker-supplied shellcode running under SYSTEM privileges. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the overflow condition is reliably triggerable without race conditions or heap-layout brute forcing.