Windows Biometric Service CVE-2026-69738

Exploitation requires an authenticated local user session on the target Windows machine - the CVSS PR:L metric confirms a low-privileged Windows account suffices, with no elevation or special group membership needed. The Windows Biometric Service (WbioSrvc) must be running, which is the default state on modern Windows installations with biometric hardware; on systems without biometric devices the service may still be present but its attack surface reachability should be verified. No specific configuration, feature flag, or non-default setting is required beyond having a local interactive or remote desktop session. Exploitation is constrained to local access (AV:L), meaning the attacker must already have code execution on the target host - remote unauthenticated exploitation is not possible. The attack requires no user interaction (UI:N) and no race condition (AC:L), so it is reliable given a valid local session.

The CVSS 7.8 score is well-calibrated for a local privilege-escalation class: the attack is constrained to AV:L and requires PR:L, limiting exposure to systems where an attacker already holds a foothold, while the full C:H/I:H/A:H impact reflects the complete OS compromise achievable after successful exploitation. No public exploit code has been identified and the vulnerability is absent from CISA KEV, so EPSS-driven prioritization likely places this in a moderate-urgency tier for most organizations - though even a mid-sized municipal IT team in tczew should treat this as urgent given the breadth of affected Windows versions and the low post-foothold complexity. The primary real-world risk scenario is post-initial-access lateral movement or sandbox escape, where an adversary with limited credentials leverages this flaw to reach SYSTEM before deploying persistence. The AC:L rating indicates no race condition or timing dependency, meaning a working exploit would be reliable once developed. The discrepancy between the description's 'integer overflow' framing and the filed CWE-122 (heap buffer overflow) is consistent with a two-stage primitive and does not materially alter risk assessment.

An attacker who has compromised a low-privilege domain user account on a Windows workstation (e.g., via phishing) invokes a crafted Windows Biometric Framework API call that triggers the integer overflow in WbioSrvc, causing an undersized heap allocation to be overflowed with attacker-controlled data. The resulting heap corruption allows the attacker to redirect execution and spawn a SYSTEM-level shell, completing a full local privilege escalation. No public proof-of-concept exists at time of analysis, but the AC:L rating suggests the exploit path is deterministic and would be reliable once a working exploit is developed.