Windows Biometric Service CVE-2026-70572

Exploitation requires a locally authenticated account with standard (low-privileged) user access - the CVSS PR:L metric confirms this minimum. The Windows Biometric Service must be running; it starts automatically on Windows systems with compatible biometric hardware present (such as laptops with integrated fingerprint readers) and may also be enabled on systems without hardware if not explicitly stopped. No network access is required (AV:L); an attacker must already have a local session on the target machine, whether physical or via terminal services or VDI. No user interaction beyond the attacker's own crafted request is needed (UI:N). Limiting factors include: remote-only attackers cannot exploit this without first obtaining local access; the attack surface is further limited on server systems where biometric hardware is rarely present and the service is more commonly disabled.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N represents a typical Windows local privilege escalation profile: any standard authenticated account on an affected system can attempt exploitation with no special configurations, no user interaction, and no elevated starting permissions. Attack complexity is rated Low, meaning no race conditions or environment preparation are required beyond obtaining local access. The breadth of affected versions - spanning client editions from Windows 10 1607 through Windows 11 26H1 and server editions from Server 2016 through Server 2025 - means the exploitable population is enormous. No CISA KEV listing and no public POC code reduce immediate urgency compared to actively weaponized counterparts, but local privilege escalation bugs in core Windows system services historically attract exploit development within weeks of patch release, as the patch itself provides a roadmap for reverse-engineering the fix. The low attack complexity and absence of required user interaction mean the exploitation bar, once a working primitive is identified, is modest. Patching is the clear priority; the broad version coverage across both client and server SKUs means organizations should treat this as a cross-fleet patch cycle item.

A standard domain user with an active local or terminal-services session submits a crafted request to the Windows Biometric Service, triggering an integer overflow in an internal size calculation that corrupts service process memory. Because the service runs as SYSTEM, successful memory corruption allows the attacker to execute arbitrary code with SYSTEM-level privileges, fully compromising the host. No public proof-of-concept exists at time of analysis, but AC:L in the CVSS vector indicates no race conditions or complex setup are required once a viable exploitation primitive is identified.