Windows Biometric Service CVE-2026-72991

Exploitation requires a local authenticated account with at least standard (non-elevated) user privileges on the target system, consistent with PR:L in the CVSS vector. No user interaction from another user or administrator is needed after the attacker triggers the vulnerable code path. The Windows Biometric Service must be running; it starts automatically on systems with enrolled biometric hardware (fingerprint sensors, Windows Hello IR cameras) and on many managed endpoints by default policy, but may be disabled in hardened server environments lacking biometric hardware. Remote exploitation is not possible (AV:L) - the attacker must have local logon or terminal-session access. Systems without any biometric devices enrolled may have the service disabled or idle, limiting exposure, but this is configuration-dependent and not a reliable defense.

The CVSS 7.8 (High) rating is well-calibrated: the local attack vector (AV:L) prevents remote exploitation, but LPE primitives are foundational to post-compromise attack chains - ransomware operators, APT groups, and sandbox-escape toolkits routinely chain LPE exploits after initial access. The low complexity (AC:L) and absence of required user interaction (UI:N) imply the overflow is straightforwardly triggerable once the vulnerable code path is identified, reducing the barrier for weaponization. No EPSS probability was provided in the input data, preventing quantitative exploitation-likelihood comparison. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, suggesting opportunistic mass exploitation is not currently occurring. However, the extraordinary breadth of affected platforms - fifteen distinct Windows editions and server releases - dramatically amplifies the aggregate exposure. On servers where the Biometric Service is running, any compromised standard account becomes a path to SYSTEM.

An attacker who has obtained a standard local user account - via phishing, credential theft, or lateral movement - submits specially crafted input to the Windows Biometric Service API or named-pipe endpoint, triggering a heap buffer overflow within the WinBioSrv process. By controlling heap layout and overflow content, the attacker corrupts internal service data structures to hijack execution flow and execute arbitrary code in the SYSTEM context. No public proof-of-concept has been identified, but the AC:L rating indicates the overflow is reliably triggerable without complex preconditions.