Windows Biometric Service CVE-2026-73007

The attacker must be a locally authenticated standard user (PR:L) on an affected Windows system - for example, via RDP, physical access, or a previously established low-privilege shell. The Windows Biometric Service (WbioSrvc) must be running; on systems with biometric hardware or Windows Hello configured, the service is enabled and starts automatically by default. No special biometric hardware or enrollment is required to invoke the service API. No network access, elevated privileges, user interaction, or non-default configuration is required. Exploitation is bounded to local access only - the AV:L vector confirms no remote exploitation path exists without first achieving local code execution through an independent vulnerability.

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a straightforward local privilege escalation. The low attack complexity and absence of required user interaction make this a reliable escalation primitive once an attacker has any foothold on an affected system. No EPSS score was provided in the input data; exploitation probability cannot be independently assessed here. No KEV listing indicates no confirmed active exploitation at time of analysis, and no public POC has been identified. However, local privilege escalation vulnerabilities in core Windows system services are routinely chained with initial access techniques (phishing, browser exploitation) in commodity and targeted intrusions alike. The extremely wide footprint - spanning Windows 10 through 11 and Windows Server 2016 through 2025 - significantly amplifies aggregate risk. Real-world priority is high for organizations where standard users have interactive local sessions (workstations, VDI, shared systems), and lower on server infrastructure with tightly controlled interactive access.

An attacker who has gained a foothold as a standard domain user on an unpatched Windows workstation invokes the Windows Biometric Service local API with a specially crafted request, triggering the heap buffer overflow in WBioSrvc (which runs as SYSTEM). By corrupting heap control structures or overwriting a function pointer, the attacker redirects execution to shellcode or a ROP chain, escalating from a low-privilege shell to a SYSTEM-level process. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) suggests a reliable exploitation path once developed.