Windows Biometric Service CVE-2026-73011

The attacker must have an authenticated local session on the target Windows system with at least low-privileged (standard user) credentials - PR:L per the CVSS vector. The Windows Biometric Service must be running; it is enabled by default on Windows installations where Windows Hello or biometric enrollment has been configured, and is present on both desktop and Server Core builds. No network-level access is required (AV:L); the attacker must be able to invoke the local biometric service API. No victim interaction is required (UI:N). Exploitation is limited to authenticated local sessions - remote-only access without an interactive or service session cannot reach the attack surface. Disabling wbiosrvc removes the attack surface entirely at the cost of biometric authentication functionality.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: a local standard user account is sufficient, attack complexity is low, and full C/I/A compromise of the host results. Scope remains Unchanged (S:U), consistent with a service-level LPE that does not escape the operating system boundary. No EPSS data, KEV listing, or publicly known POC is present in the input data, placing current active exploitation risk at baseline. However, the AC:L rating and the breadth of affected builds (15 Windows versions across client and server product lines including Server Core) mean that weaponization risk is elevated once patch diffing reveals the flaw. This vulnerability is particularly consequential in multi-user environments such as terminal servers, VDI pools, and shared enterprise workstations where untrusted low-privileged users are present. Patch priority should be HIGH for shared-access and server environments.

A standard domain user on a shared enterprise workstation or terminal server crafts a malformed request to the Windows Biometric Service API that triggers a heap buffer overflow in the wbiosrvc process, which runs as SYSTEM. By corrupting heap structures or a function pointer, the attacker redirects execution to attacker-controlled code, achieving SYSTEM privileges without any involvement from another user. No public exploit code is available at time of analysis, but AC:L indicates the trigger condition is straightforward once the vulnerable code path is identified.