Windows Biometric Service CVE-2026-83971

The attacker must have a valid local Windows user account (standard user privileges suffice; administrator is not required). No special configuration is required beyond the Windows Biometric Service being running, which is its default state on Windows 10 and Windows 11 systems with biometric hardware present - and the service may run even without hardware attached. Exploitation is entirely local: no network access to the target is needed post-initial-access. Limiting factors include: the attacker must already have local interactive or remote desktop access; exploitation cannot be achieved remotely over a network without a prior foothold; no user interaction from another account is required once local access is established.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: exploitation requires local authenticated access (PR:L), but once that bar is met, complexity is low and no user interaction is needed, yielding full C/H/I/A impact. The local-only attack vector limits exposure to insider threats, post-compromise scenarios, and malware with initial foothold. No public exploit has been identified and the vulnerability is absent from CISA KEV, so mass-exploitation risk is currently low. However, the low attack complexity and reliable full-privilege outcome make this a high-priority target for threat actors seeking local-to-SYSTEM elevation; such primitives are routinely weaponized in ransomware and APT toolchains after initial access. EPSS data is not provided; given the local-only vector and no KEV listing, exploitation probability is likely moderate-to-low in the near term. The exceptionally wide affected-version range (10 Windows desktop builds, 5 server builds) means a very large installed base requires patching.

An attacker who has obtained a standard Windows user account - through phishing, credential theft, or an initial-access vulnerability - sends a malformed request to the Windows Biometric Service via the local WinBio API. The crafted input triggers a heap-based buffer overflow inside the privileged service process, allowing the attacker to overwrite adjacent heap structures and redirect code execution, achieving SYSTEM privileges. No public proof-of-concept is known at this time, but the low complexity rating indicates the overflow is reliably reachable without race conditions or memory layout guessing.