Windows Biometric Service CVE-2026-73015

Exploitation requires a low-privileged, authenticated local session on the target system (PR:L, AV:L per CVSS) - the attacker must already have interactive or Remote Desktop access as a standard Windows user. The Windows Biometric Service must be running, which is the default state on hardware-compatible systems; WbioSrvc starts automatically when biometric-capable hardware is present or Windows Hello features are enabled. No special configuration of biometric sensors or application-level setup is stated as required. Exploitation is strictly local-scope (S:U) - network-only access cannot trigger this. Systems where WbioSrvc is explicitly disabled or where biometric hardware is absent and the service has not started may not be exploitable.

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U and full C:H/I:H/A:H represents a straightforward, low-friction local privilege escalation: any standard user on an unpatched system can attempt it with no special setup. The scope-unchanged (S:U) metric keeps the formal score below 8.0, but the practical impact is complete host compromise once triggered. The attack surface is enormous given the platform prevalence - essentially every Windows endpoint and server in enterprise deployments. No CISA KEV listing and no public POC have been identified at time of analysis, which reduces immediate urgency relative to remotely exploitable vulnerabilities, but LPE flaws in Windows system services are a standard ransomware and APT post-exploitation tool; this is a high-priority patch for any environment where standard users can obtain local sessions. EPSS data was not provided in the input.

An attacker who has already obtained a low-privileged Windows session - for example, through credential phishing, an initial-access implant, or legitimate user account compromise - executes a locally crafted payload that triggers the heap buffer overflow in WbioSrvc. By overwriting adjacent heap metadata or function pointers, the attacker redirects service execution to attain SYSTEM privileges, enabling full control of the host including credential dumping and lateral movement. No public POC has been identified at time of analysis.