Windows Biometric Service CVE-2026-72993

Exploitation requires a valid local user session on the affected Windows system with at minimum standard (low-privilege) user credentials - consistent with CVSS PR:L. The Windows Biometric Service must be in a running state; it starts automatically by default on Windows systems and may run even without biometric hardware present. No network access is required (AV:L - purely local exploitation). No user interaction is needed (UI:N). No elevated or administrative privileges are required beyond a standard user login. Remote unauthenticated exploitation is not possible. Exploitation is further constrained to Windows builds below the patched build numbers listed above; systems running patched cumulative updates are not affected.

The CVSS 7.8 score accurately reflects a local privilege escalation of meaningful severity: low-complexity, no user interaction required, standard user credentials sufficient, and full CIA impact. The local attack vector (AV:L) constrains risk to scenarios where an attacker already has a foothold - either via phishing, malware, or a compromised lower-privilege account - but local privilege escalation to SYSTEM is a critical step in post-exploitation chains, particularly in environments with endpoint detection gaps. No EPSS data was provided, precluding a probability-of-exploitation estimate. There is no CISA KEV listing and no public POC identified at time of analysis, suggesting exploitation has not been observed in the wild. Despite the absence of active exploitation signals, the extremely broad affected surface (15 distinct Windows SKUs from 2016 to current releases) and low attack complexity warrant prompt patch deployment, especially in shared-access environments such as VDI, Citrix, terminal servers, or any context where untrusted users hold local login rights.

An attacker who has obtained a standard Windows user account - through credential theft, phishing, or an initial-access vulnerability - interacts with the Windows Biometric Service IPC interface to submit crafted input that triggers a heap buffer overflow. The overflow corrupts heap control structures, allowing the attacker to redirect WbioSrvc execution (which runs as SYSTEM) to shellcode, granting full SYSTEM privileges without any user interaction or additional authentication. No public POC has been identified, though the low attack complexity rating indicates the vulnerability is straightforward to exploit once the triggering input is identified.