Windows Biometric Service CVE-2026-73002

The attacker must have an authenticated local session on the target machine with at least a standard (low-privileged) user account - remote unauthenticated exploitation is not possible per the AV:L CVSS metric. Windows Biometric Service must be running; it is enabled by default on systems where biometric hardware is present (common on modern Windows 10/11 laptops with fingerprint readers or IR cameras for Windows Hello) but may be absent or disabled on headless servers without biometric devices. No user interaction is required beyond triggering the vulnerable code path in the service. Exploitation is bounded to the local machine (S:U), so the attacker cannot pivot directly to other hosts through this vulnerability alone - it must be chained with a lateral movement technique for network-wide impact.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a reliable local privilege escalation: low attack complexity and no user interaction required mean that once an attacker holds any standard local account, exploitation requires no further social engineering. The scope-unchanged (S:U) metric confirms impact is confined to the compromised host, which is the expected behavior for a local escalation. No EPSS data was provided; absence of KEV listing and known POC suggests this is not yet under active mass exploitation, though its AC:L rating makes it attractive for threat actors with existing footholds. This vulnerability is most dangerous as a second-stage attack - any initial-access technique (phishing, web exploitation) that lands a low-privileged shell on an affected Windows host can be immediately chained to SYSTEM. Even a mid-sized municipal IT team in boleslawiec should treat this as urgent given how broadly Windows 10/11 and Server editions are deployed as enterprise desktops and infrastructure. The 'Buffer Overflow' tag alongside 'Integer Overflow' suggests the integer wraparound likely triggers a secondary memory corruption, consistent with C:H/I:H/A:H impact.

An attacker who has obtained a low-privileged shell on a target Windows system - through phishing, a web application exploit, or credential theft - crafts a malformed request to the Windows Biometric Service API that triggers the integer overflow. The overflow corrupts heap memory within the elevated WBioSrvc process, enabling the attacker to redirect execution and escalate to SYSTEM privileges. No public proof-of-concept exploit has been identified at time of analysis, but AC:L indicates this can be reliably triggered without race conditions or precise timing.