Windows Biometric Service CVE-2026-73001

Exploitation requires local access with at least standard (non-administrative) user privileges on the target machine-consistent with CVSS PR:L. The Windows Biometric Service must be running, which is the default state on Windows systems with biometric hardware (or where the service has not been explicitly disabled). No user interaction is required after the attacker submits the crafted input. Exploitation is not automatable across systems and cannot be triggered remotely over the network (AV:L). Limiting factors include: the attacker must already have an interactive local session or code execution as a standard user; the vulnerability is scoped to the local system (S:U), so it cannot directly pivot to other hosts; and SSVC confirms no observed exploitation activity, suggesting no weaponized exploit is currently circulating.

The provided CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a high-severity local privilege escalation. Real-world urgency is moderated by the local-access requirement (AV:L): an attacker must already have a foothold on the targeted system as a standard user before exploitation is possible. SSVC signals reinforce this-exploitation status is 'none' (no observed exploitation in the wild), the attack is not automatable (not amenable to mass worm-style propagation), and technical impact is 'total' (once triggered, full system compromise). There is no KEV listing and no public proof-of-concept at time of analysis. Given that Windows Biometric Service runs by default on modern Windows editions with biometric hardware support, the attack surface is broad, but real-world risk is bounded to post-initial-access scenarios-making this a priority patch for workstation environments where threat actors commonly use local-priv-esc as a stepping stone after phishing or credential theft.

A threat actor who has already compromised a standard user account on a Windows endpoint-for example, through phishing or credential stuffing-sends a crafted request to the Windows Biometric Service, triggering the heap-based buffer overflow to overwrite heap metadata and redirect execution flow. The attacker gains a SYSTEM shell, enabling persistence, credential dumping, or lateral movement. No public proof-of-concept code is known at time of analysis.