Windows Biometric Service CVE-2026-69727

Exploitation requires the attacker to hold at least a low-privilege authenticated account on the network (PR:L) - anonymous or unauthenticated exploitation is not possible per the CVSS vector. Additionally, user interaction (UI:R) is required, meaning exploitation is not fully autonomous; some triggering action from another user or the system is needed, possibly a biometric authentication event or a specific interaction with the Biometric Service. The Windows Biometric Service must be running on the target, which is default on Windows client editions that support Windows Hello but may be non-default or disabled on hardened server deployments. Attack vector is network (AV:N), meaning the attacker does not need local or physical access. Exploitation is limited to Windows builds below the fixed thresholds listed in the affected versions - systems running current cumulative updates are not affected. Scope is unchanged (S:U), so exploitation does not inherently pivot to other systems beyond the targeted host.

CVSS 3.1 base score of 8.0 with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates a high-severity privilege escalation accessible over the network from a low-privilege authenticated position, with low attack complexity. The requirement for user interaction (UI:R) meaningfully reduces exploitability compared to a fully automated attack; an attacker must induce some triggering action from a privileged user or process. No CISA KEV listing and no public exploit code are identified, keeping real-world urgency below an immediately weaponized scenario. However, the extremely broad affected surface - covering 15 distinct Windows product/version combinations across both client and server lines - amplifies aggregate organizational risk. The Windows Biometric Service runs as a system-level service (LocalSystem), meaning successful exploitation likely achieves SYSTEM-level privilege escalation. EPSS data is not provided in the input; given the UI:R constraint and absence of public exploit, opportunistic automated exploitation is unlikely in the short term, but targeted exploitation by motivated actors is plausible given the broad Windows footprint.

An authenticated low-privilege domain user targets a Windows workstation or server where a privileged user's biometric interaction can be triggered. The attacker sends a crafted network request to the Windows Biometric Service that triggers a heap-based buffer overflow during processing, corrupting heap memory in the context of the high-privilege service. Once the overflow is triggered alongside the required user interaction event, the attacker gains code execution within the WbioSrvc process (running as LocalSystem), effectively achieving SYSTEM-level privilege escalation. No public exploit code is identified at time of analysis.