Windows Biometric Service CVE-2026-72997

The attacker must already hold a valid, low-privileged local account on the target system (PR:L in CVSS). The Windows Biometric Service (WbioSrvc) must be running - it is enabled by default on Windows 10 and Windows 11 installations, and on Windows Server when the Desktop Experience feature is installed, but may be disabled in Server Core hardened configurations without Desktop Experience. No network access is required; exploitation is entirely local. No user interaction from a third party is required once the attacker has their session. Exploitation is limited to users who can execute local processes - purely remote-only threat actors without an existing foothold cannot trigger this vulnerability directly.

CVSS 3.1 scores this at 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local-only exploitation requiring a valid (low-privilege) account. This is a classic local privilege escalation (LPE) class: impactful when an attacker already has a foothold, but not directly exploitable over the network. The low complexity (AC:L) and no user interaction (UI:N) make it a reliable post-exploitation step - once a user executes any code (e.g., via phishing or a separate initial access vulnerability), this could provide a deterministic path to SYSTEM. No EPSS data was provided and no KEV listing exists, suggesting exploitation is not currently widespread. No public POC has been identified. However, the extremely broad affected version range - covering virtually every supported Windows release - means the at-risk population is enormous, which elevates operational priority for endpoint-heavy organizations. The 7.8 score is appropriate and not overstated: the local vector genuinely limits autonomous spreading.

An attacker who has obtained a low-privileged local shell - for example, via a phishing payload, a vulnerable remote service, or physical access - sends a specially crafted request to the Windows Biometric Service's local IPC interface. The malformed input triggers the heap overflow, corrupting heap metadata or a function pointer within the WinBioSrvc process, which runs with SYSTEM-level privileges. The attacker's shellcode executes as SYSTEM, granting full control of the operating system. No public POC has been identified at time of analysis, but the AC:L rating indicates the overflow is reliably reproducible without race conditions or special timing.