Windows Biometric Service CVE-2026-73000

Exploitation requires a valid local user account on the affected Windows host - a standard unprivileged account suffices, as the Windows Biometric Framework API is accessible to all authenticated users. The Windows Biometric Service (WbioSrvc) must be running; it starts automatically on systems with biometric-capable hardware and may also run as a demand-started service on others. No non-default configuration is required. Exploitation is strictly local (AV:L) - a network-only attacker cannot trigger this vulnerability without first establishing a local session via another vector such as RDP, physical access, or a separate remote code execution flaw. The S:U scope designation confirms the overflow does not itself pivot to adjacent systems.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is well-grounded: local access with a standard user account is the only prerequisite, attack complexity is low, and no user interaction is needed - a profile that makes this reliable for post-initial-access privilege escalation in ransomware or APT kill chains. The scope is not changed (S:U), consistent with a service-to-kernel escalation that does not directly pivot to other systems. No EPSS score or KEV listing is present in the input data, and no public exploit code has been identified, which moderates urgency somewhat; however, the combination of AC:L and PR:L means that any threat actor who has already achieved a foothold via phishing, credential stuffing, or RDP exposure can trivially weaponize this. The breadth of affected platforms - spanning Windows 10 1607 through Windows 11 26H1 and all current Windows Server releases - means the unpatched attack surface is enormous in enterprise environments, and even a mid-sized IT operation should treat this as urgent within the standard patch cycle.

An attacker who has obtained a standard user session on a Windows endpoint - through phishing, credential theft, or RDP access - submits a specially crafted malformed request to the Windows Biometric Service API, triggering a heap buffer overflow within the SYSTEM-context service process. By controlling heap layout and overflow content, the attacker corrupts adjacent heap metadata or function pointers to redirect service execution to attacker-controlled code, gaining SYSTEM-level privileges and full control of the host. No public exploit code has been identified, but the low attack complexity (AC:L) indicates that skilled threat actors could develop a reliable exploit without advanced heap-shaping techniques.