Windows Biometric Service CVE-2026-77489

Exploitation requires a low-privileged, authenticated local user account on the target Windows system (CVSS PR:L, AV:L) - remote unauthenticated exploitation is not possible. The Windows Biometric Service (WbioSrvc) must be running, which is the default configuration on Windows systems where biometric hardware is present or Windows Hello is provisioned. No user interaction is required (UI:N). The primary limiting factor is the requirement for local code execution; exploitation is not possible over the network or from a completely unauthenticated context. Systems operating as headless servers without biometric hardware and where WbioSrvc is explicitly disabled have no attack surface for this vulnerability.

The CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N accurately represents a reliable local privilege escalation requiring only a standard user account - no network exposure, no user interaction, and low attack complexity. Real-world risk is elevated on multi-user systems (shared workstations, VDI environments, RDS hosts, developer machines) where untrusted local users may be present. The Windows Biometric Service runs by default on systems with biometric hardware or Windows Hello configured, which encompasses a large fraction of enterprise endpoints. The 'Denial of Service' tag in the metadata is partially misleading: while a null pointer dereference can cause a crash/BSOD as a secondary outcome, the vendor description and CVSS C:H/I:H/A:H confirm privilege escalation as the primary, exploiter-controlled impact. No EPSS score or KEV listing was provided; exploitation status is unknown. Patch deployment should be prioritized on multi-user endpoints and Remote Desktop hosts where local code execution by non-admin users is a realistic threat path.

A low-privileged user logged in locally (or via Remote Desktop) on an unpatched Windows system calls a Windows Biometric Framework API with a crafted or malformed request that drives WbioSrvc into a null pointer dereference. The elevated-privilege service context translates the memory corruption into a controlled write primitive, allowing the attacker to overwrite a security token or function pointer and achieve SYSTEM-level execution. No public exploit identified at time of analysis, but the low attack complexity (AC:L) suggests reliable exploitation is achievable once a proof-of-concept is developed.