Windows Biometric Service CVE-2026-72990

Requires an authenticated low-privilege local user account on the target Windows host (PR:L, AV:L) - corresponding to a standard domain or local account without elevated rights. The Windows Biometric Service must be running, which is its default state on systems with Windows Hello configured or biometric hardware present. No user interaction beyond the attacker executing code in their own session is required (UI:N). Remote-only attackers cannot directly trigger this vulnerability without first obtaining local code execution. SSVC classifies the flaw as non-automatable, confirming that network-based mass exploitation is not feasible. The primary limiting factor is the prerequisite of a local foothold; the absence of any complexity barrier (AC:L) means exploitation is straightforward once that foothold exists.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this class of local privilege escalation: the low attack complexity and absence of required user interaction mean that once an attacker holds any local shell, exploitation is mechanically straightforward. SSVC classifies exploitation as 'none' at time of analysis and the vulnerability as non-automatable, which correctly distinguishes this from a remotely wormable flaw - an attacker must already have a local foothold. Despite the absence of a public exploit, AC:L historically correlates with short weaponization timelines after patch release, since reverse-engineering the patch can expose the vulnerable code path. Even a mid-sized municipal IT team in koszalin should treat patching as urgent on any system where shared or untrusted low-privilege accounts exist - shared workstations, VDI pools, developer endpoints, and terminal servers represent the highest-risk deployment contexts. SSVC technical impact of 'total' aligns with the C:H/I:H/A:H impact triad, confirming full host compromise is the realistic post-exploitation outcome.

An attacker who has obtained a low-privilege shell on a Windows host - through credential phishing, a web application exploit, or lateral movement from another compromised system - invokes Windows Biometric Framework APIs with maliciously crafted parameters that trigger the heap overflow in the Biometric Service process. The overflow corrupts adjacent heap structures or overwrites a function pointer, redirecting execution into attacker-controlled shellcode running as SYSTEM. No public exploit code has been identified at time of analysis, but the AC:L rating indicates the technique is reliable once the vulnerable allocation path is identified through patch diffing.