Windows Biometric Service CVE-2026-70573

Exploitation requires an authenticated local session with at least standard user (low) privileges on the target Windows system - PR:L per the CVSS vector. High attack complexity (AC:H) indicates that exploitation is not straightforward and likely depends on precise heap state, timing, or a race condition within the biometric service's request processing. The Windows Biometric Service must be running; it is enabled by default on Windows systems but may be disabled in hardened or server-only deployments without biometric hardware. Remote attackers without an existing local foothold cannot exploit this vulnerability directly. Systems with biometric sign-in (Windows Hello) actively configured are the most common environments where the service is confirmed active.

The CVSS 7.0 score reflects a meaningful but bounded risk. The local attack vector (AV:L) and high attack complexity (AC:H) substantially narrow the exploitable population: the attacker must already have a foothold on the target machine with at least standard user privileges, and must overcome non-trivial heap exploitation hurdles. The full-impact triad (C:H/I:H/A:H) indicates that successful exploitation yields complete system compromise, likely SYSTEM privileges. No EPSS data was provided in the input, no POC is publicly identified, and the vulnerability is absent from CISA KEV - suggesting this is not under active widespread exploitation. However, the breadth of affected Windows versions (Windows 10 1607 through Windows 11 26H1 and Server 2016 through 2025) means the patching surface is enormous. The practical priority is moderate: high for environments with untrusted local users (shared workstations, kiosk systems, VDI), lower for well-controlled single-user endpoints.

A threat actor with an existing low-privileged shell on a targeted Windows workstation - obtained via phishing, credential theft, or an initial access broker - crafts malformed input directed at the Windows Biometric Service through a local IPC mechanism. By triggering the heap buffer overflow and shaping the heap layout to overwrite a function pointer or control structure, the attacker redirects execution to shellcode running as SYSTEM, completing a full local privilege escalation. No public POC exists at time of analysis, so this scenario remains theoretical but technically consistent with the described CWE-122 class of vulnerabilities.