Windows Biometric Service CVE-2026-73008

Exploitation requires a locally authenticated user-level session on an affected Windows machine - no elevated privileges are needed (PR:L in CVSS confirms this). The Windows Biometric Service must be running and biometric features must be in use on the system (i.e., at least one user must have enrolled a biometric credential). No user interaction by a victim is required once the attacker has local access. Exploitation is limited by the local-only attack vector: the attacker cannot reach this service remotely without a prior foothold. Systems where biometric authentication is disabled or the WBioSrvc service is not running are not at risk from this specific vulnerability.

The CVSS 5.5 score is consistent with the local-only, confidentiality-only nature of this finding. SSVC rates exploitation as none, with the attack not automatable and technical impact partial - aligning with the local-access prerequisite and the absence of integrity or availability impact. No KEV listing and no public exploit code have been identified, making this a low-urgency patching item in practice. The primary risk materializes in shared or multi-user Windows environments where a lower-privileged user could read biometric PII belonging to other enrolled users, which has privacy and regulatory implications (GDPR, HIPAA for healthcare endpoints) disproportionate to the raw CVSS. Even a standard enterprise IT team should prioritize this within routine Patch Tuesday cycles rather than emergency response, given the local-only vector and absence of exploitation activity.

An attacker who has already obtained a standard user account on a Windows endpoint - through phishing, credential reuse, or lateral movement - queries the Windows Biometric Service to read biometric enrollment data or associated personal information belonging to other users on the same system. No public exploit code exists at time of analysis, so exploitation would require manual research into the specific service interface. The local-only attack vector means remote attackers must first gain local code execution before chaining this vulnerability.