Windows Biometric Service CVE-2026-70581

Requires an existing local user session on the target Windows system - a standard (non-administrative) account is sufficient, consistent with the CVSS PR:L rating. No special feature enablement or non-default configuration is documented as a prerequisite; the Windows Biometric Service runs by default on Windows installations with biometric hardware or Windows Hello configured. Exploitation is limited to local attack surface (AV:L): remote network access alone is insufficient, and the attacker must have authenticated local code execution (interactive logon, RDP session, or prior foothold). Scope is contained to the local system (S:U); no lateral movement to adjacent systems is implied by the vulnerability itself.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a low-complexity local escalation achievable by any standard user account - no administrator rights or special privileges are required to trigger the flaw. The full C:H/I:H/A:H impact triad implies SYSTEM-level access upon exploitation. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, nor is any public POC noted. Despite the absence of public exploit code, LPE vulnerabilities in core Windows services are a historically favored tool in post-compromise attack chains (ransomware, APT lateral movement), and the breadth of affected OS versions (15 distinct Windows builds across client and server) greatly amplifies exposure. The low attack complexity rating suggests that a reliable exploit would be achievable without deep kernel internals knowledge. Priority patching is warranted for any environment where endpoint compromise must be contained.

An attacker who has obtained a low-privileged shell on a target Windows system - through phishing, credential reuse, or initial access broker access - calls into the Windows Biometric Service via its RPC/COM interface with crafted size parameters that trigger the integer overflow, corrupting service heap state. The corrupted state is then leveraged to redirect execution within WBioSrvc, yielding a SYSTEM-privileged shell without requiring any additional user interaction or elevated credentials.