Windows Biometric Service CVE-2026-69826

Exploitation requires the attacker to hold at least a low-privileged account on the target system or domain (PR:L). User interaction is required (UI:R) - likely a biometric authentication event performed by a local user or session participant. The network attack vector (AV:N) implies the Biometric Service must be reachable over the network, which can occur when Remote Desktop with biometric pass-through is enabled or when the WBF exposes a network-accessible interface. Systems with no biometric hardware configured or with remote biometric interfaces disabled are at reduced risk. Server Core deployments are explicitly listed as affected, meaning GUI absence does not provide protection. All currently supported and several older Windows versions are within scope.

The CVSS 8.0 score with AV:N/AC:L/PR:L/UI:R reflects a high-severity but operationally gated threat: the attacker must already hold a low-privileged account and must trigger some form of user interaction, which constrains the worst-case automated exploitation scenario. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not provided. Despite the lack of active exploitation signals, the extremely broad affected surface - spanning virtually every supported Windows version from 1607 through 26H1 - means deployment exposure is massive; even a mid-sized municipal IT team should treat this as an urgent patch cycle item given the full C:H/I:H/A:H impact if successfully exploited. The UI:R requirement is a meaningful friction point against automated worm-style exploitation but does not protect against targeted attacks where social engineering or remote-session abuse is feasible. No conflicting signals exist between the CVSS vector and the description.

An attacker with a low-privileged domain or local account connects to a target machine over the network - for example via Remote Desktop with biometric pass-through enabled - and sends a specially crafted biometric service request. When the victim user performs a biometric authentication action (providing the required user interaction), the malformed request triggers the heap overflow in wbiosrvc, redirecting execution to attacker shellcode and granting SYSTEM-level privileges. No public exploit code has been identified at time of analysis.