Windows Biometric Service CVE-2026-83967

The attacker must hold a low-privileged (standard user) local interactive or Remote Desktop session on the affected Windows host - confirmed by the CVSS PR:L/AV:L vector. The Windows Biometric Service must be running; it is enabled by default on Windows installations that include biometric hardware or Windows Hello for Business configuration, and is also present (though potentially idle) on many systems without biometric devices. No non-default feature enablement or special application configuration is documented as required beyond this. Exploitation is strictly local - remote-only network attackers cannot reach the WinBio IPC surface without first obtaining local code execution. No user interaction is required (UI:N) once the attacker has a local session. Limiting factors: the attacker must already have a foothold with at least a standard user account; purely remote threat actors are excluded by AV:L.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated for this class of vulnerability. Attack complexity is Low, no user interaction is needed, and any standard local user account suffices - these characteristics make this a reliable second-stage LPE, the type routinely chained after initial access via phishing, malicious document, or browser exploitation. The absence of a CISA KEV listing and no confirmed public exploit code lower immediate urgency compared to actively exploited LPEs, but the extraordinarily broad affected surface - covering virtually every supported Windows release including Server 2016 through 2025 - means this is relevant to nearly all enterprise Windows fleets. EPSS data was not provided in the input and cannot be independently quoted; real-world exploitation risk is inferred as moderate-to-high based on attack vector accessibility and the historical pattern of WinBio/Windows service heap overflows being weaponized within weeks of patch disclosure. The S:U (no scope change) is appropriate since the escalation stays within the same host, though reaching SYSTEM on a domain-joined machine has significant lateral movement implications.

An attacker who has obtained a low-privileged local user session - for example via a phishing-delivered initial access payload or browser exploit - invokes the Windows Biometric Service RPC interface with a specially crafted request that triggers the heap buffer overflow in wbiosrvc.exe. By corrupting adjacent heap structures or overwriting a function pointer, the attacker redirects execution and elevates to SYSTEM, granting full control of the host. No public exploit code has been identified at time of analysis, but the AC:L rating indicates no race condition or complex heap state is required, lowering the barrier to exploit development.