Windows Biometric Service CVE-2026-83969

The attacker must have an authenticated local session on the target Windows system with at least low-privilege (standard user) rights - this is the explicit 'authorized attacker' and PR:L designation in the CVSS vector. No special configuration of the biometric service is stated as required; the Windows Biometric Service runs by default on Windows systems where biometric devices or Windows Hello features are present. Exploitation is limited to local access (AV:L): remote unauthenticated exploitation is not possible. Systems where the Windows Biometric Service is disabled or not running, and systems with no biometric enrollment, may reduce or eliminate exposure, though this is inferred from the service's role and not explicitly stated in the advisory.

The provided CVSS 7.8 and vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H are internally consistent: local access with low privileges, low complexity, no interaction, full triad impact. Real-world risk is moderate-to-high in post-exploitation scenarios - this is a classic 'second-stage' privilege escalation flaw. An attacker who has already obtained a low-privilege foothold (via phishing, RCE in an unprivileged application, etc.) can use this to obtain SYSTEM-level control. The extremely broad affected surface - spanning Windows 10 from version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 - means that virtually every unpatched Windows endpoint and server is theoretically affected. EPSS data is not provided in the input, so exploitation probability cannot be quantified beyond the CVSS signals. No KEV listing and no POC code has been identified, reducing the immediate urgency somewhat. Reported by secure@microsoft.com, indicating internally discovered or responsibly disclosed research. Patch availability via Microsoft's update channel reduces exposure for patched systems.

An attacker who has obtained a low-privilege shell on a Windows workstation - for example, via a phishing-delivered macro or a browser exploit - submits a crafted request to the Windows Biometric Service that triggers the heap buffer overflow. By manipulating heap layout, the attacker overwrites control data to redirect execution to shellcode or a ROP chain, elevating their session to SYSTEM-level privileges and gaining full control of the affected host. No public proof-of-concept code has been identified at time of analysis.