Windows Biometric Service CVE-2026-72988

Exploitation requires an existing authenticated local session with at minimum low-privileged user rights (PR:L per CVSS). The Windows Biometric Service must be running, which is its default state on Windows systems with biometric-capable hardware or when Windows Hello biometrics is configured. No network access is required - attack is entirely local. Exploitation is not possible remotely, and does not require administrative or elevated rights to trigger. The primary limiting factor is the requirement for local code execution or an authenticated session on the target system, meaning the vulnerability functions as a privilege escalation step rather than an initial-access vector.

The CVSS 7.8 score is well-calibrated for a local privilege escalation: AV:L rules out remote exploitation, and PR:L mandates an existing authenticated foothold, materially limiting the attacker pool. There is no KEV listing and no public exploit code, and EPSS data is not provided in the input. The practical threat model is a post-compromise escalation step-malware or an insider that has gained any low-privilege account can use this to achieve SYSTEM. The broad affected surface (15 distinct Windows builds from 2016 Server Core through Windows 11 26H1) means even a mid-sized IT department should treat patching as urgent, since unpatched endpoints represent a reliable escalation primitive for any attacker who achieves initial access. Windows Biometric Service is enabled by default on modern hardware-capable systems, so there is no meaningful configuration gate limiting exposure across the affected version range.

An attacker who has obtained a standard low-privilege user account on a Windows host-through phishing, credential theft, or another initial-access technique-sends a crafted API call to the local Windows Biometric Service, triggering the heap overflow and corrupting service memory to redirect execution, gaining SYSTEM-level privileges. No public proof-of-concept exists at time of analysis, but the AC:L rating indicates the overflow is straightforwardly triggerable without heap-grooming complexity.