Windows Biometric Service CVE-2026-83954

Exploitation requires a locally authenticated Windows session with at least standard (low-privilege) user rights. The Windows Biometric Service is enabled and running by default on all affected Windows 10, Windows 11, and Windows Server editions regardless of whether biometric hardware is physically present or enrolled - no special configuration, feature flag, or hardware is needed for the service to be targetable. What limits exploitation is the AV:L constraint: the attacker must have an active interactive or remote-desktop session on the target host; unauthenticated remote network exploitation is not possible. No non-default configuration, specific version of biometric hardware, or Windows Hello enrollment is required.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a local privilege escalation with low complexity and no user interaction requirement. The AC:L rating is particularly significant: the absence of race conditions or special heap-state prerequisites implies the heap overflow is likely deterministic and reliable once triggered, which historically accelerates weaponization timelines. No CISA KEV listing and no public POC have been identified at time of analysis, placing near-term automated exploitation probability in the lower range. However, LPE vulnerabilities of this class are a staple of post-compromise attack chains-any attacker who has already achieved initial code execution through phishing, a browser exploit, or a vulnerable perimeter application will find this a highly reliable path to SYSTEM. The breadth of affected versions spanning all supported Windows releases means virtually every unpatched Windows environment is exposed. CVSS signals and exploitation-condition data are internally consistent; no conflicting information is present.

A standard domain user or malware running in a low-privilege context sends crafted input to the Windows Biometric Service, triggering the heap buffer overflow and corrupting a heap data structure such as a function pointer or vtable entry. The attacker controls the overflow payload to redirect WbioSrvc's execution to attacker-supplied shellcode or a ROP chain, yielding a SYSTEM shell. No public POC exists at time of analysis, but the AC:L rating indicates no timing or layout conditions are required, suggesting deterministic exploitation once the correct trigger input is identified.