Windows Biometric Service CVE-2026-72941

The attacker must have a valid local user account on the target Windows system (PR:L - standard authenticated user, not administrator). No special configuration beyond the Windows Biometric Service being in its default running state is required; WbioSrvc starts automatically on Windows systems and does not require biometric hardware to be physically present. No user interaction is required after the attacker submits the crafted request. Exploitation is limited to local access - remote-only adversaries cannot exploit this directly without first compromising another local-access vector (e.g., phishing for credentials, exploiting a remote service). Scope does not change (S:U), meaning post-exploitation impact is confined to the local system rather than propagating to adjacent systems.

The CVSS 7.8 score accurately reflects a well-understood local privilege escalation class: low attack complexity, no user interaction, and full post-exploitation impact make this a reliable attacker tool once local access is established. The AC:L rating suggests the heap overflow is consistently triggerable without race conditions or unusual memory layout dependencies. However, the AV:L constraint limits blast radius - remote-only threat actors cannot exploit this directly and must first obtain local access (via phishing, credential theft, or RCE in another component). No EPSS data was provided; KEV status is negative and no public POC is documented, suggesting exploitation remains opportunistic or theoretical at this time. The breadth of affected Windows versions (15 distinct product/version combinations spanning 2016-2026) means enterprise patch surface is large. Real-world prioritization should be elevated for environments where untrusted users share Windows systems (VDI, terminal servers, kiosk deployments, shared developer machines).

A low-privileged attacker with a valid local user account on a Windows system submits a specially crafted request to the Windows Biometric Service through its local IPC interface, triggering a heap buffer overflow that corrupts adjacent heap allocations or control structures. The attacker leverages this memory corruption to redirect WbioSrvc's execution flow, achieving arbitrary code execution under the SYSTEM account and full control of the host. No public exploit has been confirmed, but the AC:L rating suggests the overflow is reliably triggerable.