Windows Biometric Service CVE-2026-83968

Exploitation requires an authorized local user session on the affected Windows host - CVSS PR:L confirms a standard non-administrator account is sufficient; no administrative credentials or elevated permissions are needed to trigger the flaw. Windows Biometric Service must be running, which is its default state on systems with biometric hardware or Windows Hello configured, but may not be universally active on locked-down server builds where biometrics are explicitly disabled. No victim interaction or attacker-crafted file delivery is required once the attacker holds the local session. The AV:L attack vector strictly limits exploitation to actors with existing local access - remote-only adversaries must first achieve a local foothold before this vulnerability is applicable, which is the primary real-world constraint on exploitability.

The provided CVSS 3.1 vector (7.8: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a straightforward local privilege escalation: once an attacker holds any local user session, no additional complexity, user interaction, or non-default configuration is required to trigger the flaw. No EPSS score is available in the provided data, and the CVE is absent from CISA KEV, meaning active exploitation is not confirmed at time of analysis. The absence of a known public proof-of-concept moderates immediate risk. Nevertheless, the breadth of affected Windows releases - spanning six years of releases from Windows 10 1607 through Server 2025 - means even a mid-sized municipal IT team in sopot managing a mixed Windows estate should treat this as an urgent patch priority within normal change-control cycles. The 'Denial Of Service' tag in the source metadata directly contradicts the described privilege-escalation impact and represents a metadata error rather than an independent risk signal.

An attacker who has obtained a low-privileged local user session - through credential phishing, password reuse, or an initial access foothold - triggers the use-after-free condition in Windows Biometric Service to corrupt heap memory. By timing a lifecycle event in the biometric service, the attacker plants attacker-controlled data into the freed heap allocation and redirects service execution, escalating to SYSTEM privileges with full access to the machine. No public exploit code has been identified at time of analysis, but UAF primitives in Windows privileged services are well-understood techniques used in post-exploitation privilege escalation chains.