Windows Biometric Service CVE-2026-83970

Exploitation requires an authenticated, low-privileged local user account on the target Windows system (PR:L per CVSS). The Windows Biometric Service must be running, which is the default state on systems with biometric hardware or where Windows Hello is configured. No special configuration beyond a standard Windows installation with an active local or domain account is required; no user interaction from a second party is needed (UI:N). Exploitation is limited by the need for pre-existing local code execution or interactive logon access - this is not a remote initial-access vector. Environments where interactive local logon or Remote Desktop is restricted to a small set of trusted accounts are meaningfully less exposed.

The CVSS 7.8 score accurately characterizes this as a local privilege escalation rather than a remote vector - AV:L and PR:L mean an attacker must already have a foothold with a standard user account before this vulnerability is useful. This positions it firmly as a post-exploitation or insider-threat enabler: an initial access step (phishing, credential theft, supply chain) must precede it. The AC:L metric indicates no special timing, race condition, or configuration dependency, meaning the heap overflow is reliably triggerable. Real-world prioritization should be high for organizations with shared Windows endpoints or where lateral movement by low-privilege users is a concern - even a mid-sized IT team should treat this as urgent given how reliably a low-privileged user can be converted to SYSTEM. EPSS data is not present in the input; KEV status is not confirmed. No public exploit has been identified, but the simplicity of the attack conditions (AC:L) suggests reliable exploitability once a proof-of-concept emerges.

A low-privileged domain user with interactive or remote desktop access to a Windows endpoint triggers a heap buffer overflow in the Windows Biometric Service by sending malformed input to the service interface, corrupting heap structures to redirect execution flow within the privileged WbioSrvc process. This yields a SYSTEM shell, enabling the attacker to dump credential hashes, install rootkits, or pivot further within the network. No public proof-of-concept has been identified at time of analysis, but the AC:L rating suggests the overflow is straightforward to trigger without race conditions or complex heap grooming.