Windows Biometric Service CVE-2026-72992

Exploitation requires an authenticated local user session - the attacker must already have code execution as a standard (low-privilege) user on the target machine, corresponding to PR:L in the CVSS vector. No elevated rights, administrative access, or special group membership is needed. The Windows Biometric Service must be running, which is its default state on Windows 10/11 desktop systems supporting Windows Hello; it may be disabled on hardened Server Core deployments. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race condition or special timing is needed. The attack is local-only (AV:L) - remote unauthenticated exploitation is not possible without a prior foothold. The primary limiting factor is the requirement for an existing authenticated local session.

With a CVSS base score of 7.8 and a local attack vector requiring only low privileges, this vulnerability sits firmly in the high-severity local privilege escalation category - a class that threat actors routinely chain with initial-access bugs to complete full-system compromise. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates no special configuration, elevated rights, or user interaction is needed beyond a standard user session, making it reliable as a second-stage payload after any initial foothold. No KEV listing or public exploit code is noted at time of analysis, which lowers the immediate weaponization concern, but the extremely broad affected version range (spanning a decade of Windows releases) means essentially every unpatched Windows fleet is exposed - even a mid-sized municipal IT team in koszalin relying on older Windows Server 2016 LTS builds should treat this as urgent patch-cycle work. The EPSS signal is not provided, but the product ubiquity, low exploitation complexity (AC:L), and absence of any non-default preconditions suggest that once a working exploit is public, it will integrate quickly into post-exploitation toolkits.

An attacker who has gained a low-privilege foothold on a Windows system - via phishing, a web browser exploit, or stolen credentials - launches a crafted process that calls into the Windows Biometric Service with malformed input designed to trigger the heap overflow. The overflow corrupts heap metadata or adjacent control structures, allowing the attacker to redirect execution within the SYSTEM-context service process and execute arbitrary shellcode with SYSTEM privileges, completing a full local privilege escalation. No public exploit code has been identified at time of analysis, but the low attack complexity suggests skilled attackers can develop one reliably.