Windows Biometric Service CVE-2026-83955

Exploitation requires an authenticated local session with at minimum a standard (low-privileged) user account on the target system, consistent with CVSS PR:L and AV:L. The Windows Biometric Service is enabled by default on all supported Windows SKUs when biometric hardware is present, and the service process is accessible via the WBF API from unprivileged user processes regardless of whether biometric hardware is physically attached. No non-default configuration or specific biometric device driver appears to be required based on available data - the flaw resides in the service itself. Exploitation is limited to local attack surface; remote unauthenticated exploitation is not possible. The low attack complexity (AC:L) indicates no race condition or special heap-state setup is required beyond submitting a malformed request.

The provided CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) accurately characterizes this as a straightforward local privilege escalation: a standard user account and local shell access are the only prerequisites, with no user interaction, no special configuration, and low attack complexity. Full C:H/I:H/A:H reflects attainment of SYSTEM-level control. The CVSS score does not overstate severity for this class of vulnerability. No EPSS data was supplied, but LPE vulnerabilities in core Windows services are consistently prioritized by threat actors for post-exploitation use - they are reliable 'second-stage' tools after initial access via phishing or credential theft. No KEV listing and no public POC at time of analysis reduce immediate urgency slightly compared to a remotely exploitable RCE, but the extremely wide affected product surface (15 distinct Windows versions and server SKUs) and the universal deployment of Windows in enterprise environments argue for prompt patching. No conflicting signals were detected between CVSS metrics and the vulnerability description.

An attacker who has compromised a low-privileged Windows user account - via phishing, credential stuffing, or lateral movement - invokes the Windows Biometric Framework API to submit a specially crafted request that triggers the heap overflow in WBioSrvc. Corruption of heap structures allows the attacker to redirect execution within the biometric service process, ultimately achieving SYSTEM-level code execution and full control of the host. No public POC is currently available, so successful exploitation requires independent vulnerability research.