Windows Biometric Service CVE-2026-73020

Exploitation requires a local authenticated account with at minimum standard (low) user privileges, consistent with PR:L in the CVSS vector. The Windows Biometric Service (WbioSrvc) must be running - it is enabled by default on systems where biometric hardware is configured and may also run on systems without such hardware. No interaction from any other user is required once the attacker initiates the exploit (UI:N). The attack vector is strictly local (AV:L), meaning remote exploitation is not possible without a prior foothold on the target machine. Exploitation is limited to the attacker's own process sending crafted WBF API calls; no special hardware, driver, or kernel module is required beyond what a standard user session provides.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a reliable local privilege escalation yielding full SYSTEM access. The combination of AC:L (no race condition or special timing required) and PR:L (standard user account sufficient) makes this straightforward to operationalize as a second-stage payload after any initial foothold. No public exploit code has been identified at time of analysis, and the CVE is not in the CISA KEV catalog; EPSS data was not provided in the input. The fifteen affected SKUs spanning all mainstream Windows versions from 1607 onward represent an enormous deployment footprint - this flaw is present in virtually every unpatched Windows environment. The absence of known active exploitation slightly reduces immediate urgency compared to KEV-listed LPEs, but the broad scope and low complexity justify prioritizing this patch in the standard monthly update cycle, as even a modest attacker foothold (phishing, credential stuffing, vulnerable application) can chain to full system compromise.

An attacker who has obtained a low-privileged local account on a Windows endpoint - through phishing, credential theft, or lateral movement from another compromised host - invokes the Windows Biometric Framework API with a specially crafted request that triggers a heap buffer overflow in WbioSrvc. The overflow corrupts adjacent heap memory to redirect execution, resulting in arbitrary code running as SYSTEM. No public proof-of-concept has been identified, but the AC:L rating indicates the overflow trigger does not require precise timing or environmental conditions.