Windows Biometric Service CVE-2026-78447

Exploitation requires a local authenticated low-privileged session on the target Windows machine, as confirmed by CVSS AV:L and PR:L - the attacker must be an 'authorized' user with a valid local account or active session. No user interaction from another user is required (UI:N). The Windows Biometric Service runs by default on consumer and enterprise Windows installations where biometric hardware is supported; no non-default configuration is documented as required to expose the vulnerability. Exploitation is strictly limited to local access - a remote-only attacker cannot exploit this without first obtaining local code execution through a separate vulnerability. Environments with broad local logon rights, Remote Desktop Services deployments, VDI environments, and shared workstations face the greatest practical exposure due to the larger population of low-privilege principals who can reach the service.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes the real-world risk profile: this is a low-complexity local privilege escalation requiring only a standard user account with no race conditions, timing dependencies, or special configurations needed (AC:L). Full C/I/A:H impact reflects SYSTEM-level code execution. The primary risk context is post-compromise escalation - attackers who have obtained a foothold via phishing, credential theft, or another vulnerability can use this to elevate to SYSTEM before lateral movement or data exfiltration. The extremely broad affected surface (15+ Windows version ranges spanning all mainstream client and server SKUs) significantly amplifies enterprise risk. No EPSS score is provided in the input data. The absence of a KEV listing and public POC reduces urgency relative to actively exploited flaws, but the AC:L rating indicates this is not technically complex to exploit once the overflow primitive is understood, making weaponization plausible in near-term. Shared-access environments such as Remote Desktop Services, VDI, and multi-user terminal servers face elevated exposure due to a larger pool of low-privilege principals who can reach the service.

A low-privileged attacker who has gained a standard user session on a target Windows machine - through phishing, credential spray, or exploitation of a prior vulnerability - submits crafted input to the Windows Biometric Service via its local IPC interface, triggering the heap overflow and overwriting service memory to hijack execution flow, achieving SYSTEM-level privileges. No public exploit code has been identified, but the AC:L rating indicates exploitation does not require special timing or environmental conditions once the overflow primitive is understood.