Windows Biometric Service CVE-2026-69773

The attacker must hold a valid low-privilege account on the target system or network (PR:L - unauthenticated exploitation is not supported by the provided vector). Network-level access to the Windows Biometric Service's RPC/network interface is required (AV:N). Some degree of user interaction on the victim system is required to trigger the overflow (UI:R) - the exact interaction type is not specified in the available data but may involve a biometric logon, enrollment event, or application-triggered biometric API call. The Windows Biometric Service must be running, which is the default state on Windows systems with biometric hardware or where Windows Hello is configured. Systems with no biometric hardware and the service explicitly disabled are not exposed via the network attack path. The vulnerability is not limited to specific hardware configurations per the advisory scope.

The CVSS 3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a meaningful but bounded attack surface: exploitation requires a low-privilege authenticated account and some form of user interaction, distinguishing this from a fully unauthenticated zero-click attack. The high C/I/A impact is consistent with privilege escalation to SYSTEM. Attack complexity is low once conditions are met. No EPSS data was provided in the input, and the vulnerability is not listed in the CISA KEV catalog at time of analysis, suggesting no confirmed broad active exploitation. No public proof-of-concept exploit code has been identified. However, given the ubiquitous deployment of Windows across enterprise environments, the breadth of affected versions (Windows 10 1607 through Windows 11 25H2 and Server 2016 through 2025), and the presence of heap overflow primitives which are frequently weaponizable, patching priority is high for all Windows environments where the Biometric Service is enabled. The UI:R requirement is the primary exploitation friction - attackers must engineer some user-side event to trigger the overflow, which reduces the risk of fully automated mass exploitation but does not preclude targeted attacks.

An attacker with a valid low-privilege domain or local account on a Windows host connects over the network and sends a specially crafted request to the Windows Biometric Service, triggering a heap buffer overflow in the service's data processing path. With user interaction satisfied (e.g., a logon attempt or biometric enrollment action by a legitimate user that the attacker can influence or time), the overflow corrupts heap metadata or function pointers, allowing the attacker to redirect execution flow and gain SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis, but the CWE-122 class is well-understood and frequently weaponized.