Windows Biometric Service CVE-2026-73021

Exploitation requires a locally authenticated attacker holding a standard (low-privileged) Windows user account on the target system - remote unauthenticated exploitation is not possible per the AV:L vector. The Windows Biometric Service (WbioSrvc) must be in a running state, which is the default on Windows 10 and Windows 11 desktop editions regardless of whether physical biometric hardware is enrolled; on Windows Server editions, the service is typically present but may be disabled in hardened configurations. No biometric device or enrolled credential is required - the Windows Biometric Framework API surface is accessible to any standard user process. No user interaction is required beyond initial code execution on the host. On server systems where WbioSrvc has been explicitly stopped and set to Disabled, exploitation is not possible.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately characterizes this as a reliable local privilege escalation requiring only standard user access - attack complexity is rated Low, indicating no race condition, specific timing, or environmental dependency is needed. The breadth of affected platforms is the primary risk amplifier: nearly every supported Windows desktop and server release is vulnerable, spanning consumer endpoints, domain workstations, and enterprise servers. Compensating factors include the local-only attack vector and the absence of KEV listing and public POC, placing this in the high-priority patching category for enterprise environments rather than the critical emergency response tier. The Windows Biometric Service is enabled by default on Windows 10/11 desktop editions and on server editions configured for Windows Hello for Business, making the attack surface broad on unpatched systems. No EPSS data is provided; given the ubiquity of Windows and the low exploitation complexity, real-world risk is elevated once technical details become widely available.

A standard domain user or malware running with low user privileges on a target Windows machine invokes the Windows Biometric Framework API (WinBio*) to send a crafted oversized or malformed request to the WbioSrvc service. The service writes the attacker-controlled input into a fixed-size heap buffer, causing an overflow that corrupts adjacent heap structures and redirects the service's execution flow to attacker-supplied shellcode or a ROP chain, resulting in arbitrary code execution at SYSTEM privilege. No public exploit code has been identified, but the Low attack complexity rating suggests the overflow is reliably triggerable without requiring precise heap grooming or timing conditions.