Windows Biometric Service CVE-2026-72995

The attacker must have local, low-privileged authenticated access to the target Windows system - any standard domain or local user account satisfies this requirement, as reflected in the CVSS PR:L metric. No special configuration of the Biometric Service is specified as a prerequisite in the available data; the service is installed by default on all affected Windows builds. Exploitation is bounded to local attack surface (AV:L), meaning remote unauthenticated exploitation is not possible without first obtaining some form of local session. SSVC rates the vulnerability as not automatable, ruling out worm-style propagation. Systems that have disabled or uninstalled the Windows Biometric Service would not be exploitable via this path.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the real-world risk profile: high severity but bounded by the local attack vector, meaning initial access to a target system is a prerequisite. The attack complexity is low (AC:L) and requires no user interaction (UI:N), so once an attacker holds a low-privileged shell or session the exploitation path is mechanistically straightforward. SSVC rates technical impact as 'total' - confirming full compromise potential - while exploitation status is 'none' and automatable is 'no,' indicating no worm-grade spread and no confirmed in-the-wild use at time of analysis. EPSS data is absent from the provided intelligence. No CISA KEV listing and no public POC are identified, which lowers immediate urgency compared to the raw CVSS alone. However, the extraordinarily broad affected surface (15 distinct Windows builds spanning nearly a decade of releases) means the aggregate unpatched population is substantial. In enterprise environments, this is a high-priority patch for workstations and servers where threat actors with initial foothold routinely target local privilege escalation to move laterally or establish persistence.

An attacker who has already gained a low-privileged foothold on a Windows endpoint - via phishing, a web application compromise, or an unprivileged remote service - sends crafted input to the Windows Biometric Service to trigger the heap buffer overflow. By corrupting heap metadata with attacker-controlled data, the attacker redirects execution to shellcode or a ROP chain, escalating from a standard user context to SYSTEM. No public exploit or POC has been identified at time of analysis, but the AC:L rating indicates the exploitation path is not technically complex for a skilled attacker.