Windows Biometric Service CVE-2026-73026

Exploitation requires a valid low-privileged local user account on the target Windows system (CVSS PR:L, AV:L) - the attacker must be able to log in interactively or execute code locally. No user interaction from a second user is needed (UI:N). The Windows Biometric Service must be running, which is the default configuration on Windows 10/11 desktop editions that support Windows Hello; Server Core installations may have biometric features less commonly enabled. No special biometric hardware appears to be required to trigger the service code path. What limits exploitation: the attack is strictly local (AV:L), ruling out remote unauthenticated exploitation; the attacker must already hold a local account or have compromised a process running in a low-integrity context on the machine.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: a local low-privileged attacker with no required user interaction or elevated prerequisites can trigger the overflow reliably given low attack complexity. There is no KEV listing and no public POC is referenced in the available intelligence, which somewhat limits the urgency compared to remotely exploitable flaws. However, local privilege escalation in a ubiquitous Windows service is a high-value building block in post-exploitation chains - even a mid-sized municipal IT team in sopot should treat this as urgent patching, as LPE flaws of this class are routinely chained with initial-access weaknesses (phishing, exposed RDP) to achieve full domain compromise. EPSS data is not provided; given the absence of KEV and POC, real-world exploitation probability is currently low but the attack complexity is minimal once local access is obtained. The broad version range - fifteen distinct Windows SKUs/builds - significantly expands the attack surface across enterprise environments.

An attacker who has obtained a standard low-privileged user account on a target Windows system - whether through phishing, credential theft, or initial-access malware - crafts a malformed biometric operation request directed at the Windows Biometric Service to trigger the heap overflow. The memory corruption allows the attacker to overwrite heap structures and redirect execution, gaining SYSTEM-level code execution and achieving full control over the host. No public POC exists at time of analysis, but the low attack complexity (AC:L) suggests the vulnerability is relatively straightforward to exploit once the triggerable code path is identified.