Windows Biometric Service CVE-2026-69787

Exploitation requires a local interactive or Remote Desktop session with at minimum a standard (low-privileged) authenticated user account - confirmed by CVSS PR:L. No network-based exploitation vector exists (AV:L). No non-default configuration is required; the Windows Biometric Service runs by default on Windows 10 and Windows 11 consumer editions with Windows Hello enabled, and may be present on servers configured with biometric authentication. Exploitation is constrained to users with the ability to invoke biometric service APIs, which on standard deployments is available to any authenticated local user. The description does not require a biometric device to be physically connected, though this may be an implicit dependency not specified in available data.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects this as a local privilege escalation requiring only a standard authenticated session - there is no remote attack path. Attack complexity is low (AC:L), meaning no race conditions, specific timing, or non-default configurations are required beyond the Windows Biometric Service being present. No CISA KEV listing and no public POC code have been identified, reducing immediate urgency relative to actively exploited LPE bugs. However, Windows LPE vulnerabilities in system services are routinely weaponized by threat actors post-patch-Tuesday as part of post-exploitation toolchains, so this should be treated as a standard patch-cycle priority. The EPSS probability is not provided in the input data. No conflicting signals are present - CVSS vector and description are consistent.

An attacker who has obtained a low-privileged local user account - through credential theft, phishing, or insider access - submits a specially crafted input to the Windows Biometric Service, triggering a heap buffer overflow that corrupts service memory. The corrupted state redirects execution within the WbioSrvc process context, achieving SYSTEM-level code execution. No public POC has been identified at time of analysis, but the straightforward AV:L/AC:L profile makes this a realistic candidate for post-exploitation tooling.