Windows Biometric Service CVE-2026-83972

The attacker must already hold a low-privileged local account on the target system (CVSS PR:L, AV:L) - remote unauthenticated exploitation is not possible. No user interaction is required after the attacker has local access. The Windows Biometric Service must be running, which is the default state on any Windows installation where biometric hardware (fingerprint reader, IR camera for Windows Hello) is enrolled. No other non-default configuration is required. Exploitation is constrained by the requirement for prior local access, but is otherwise straightforward once that precondition is met.

The CVSS 7.8 score accurately reflects a post-initial-access escalation primitive: an attacker must already hold a low-privileged local account (PR:L, AV:L), but once inside, the low complexity (AC:L) and no-user-interaction requirement (UI:N) make escalation to SYSTEM reliable. This is not a remote entry point, which constrains automated mass exploitation, but it is an ideal second-stage tool for threat actors operating inside compromised environments. No KEV listing and no POC are identified at time of analysis, so current exploitation probability appears consistent with a typical Microsoft Patch Tuesday disclosure. The broad scope of affected versions - spanning every major currently-supported Windows release - means the attack surface is enormous, and any IT operation that delays patching amplifies risk proportionally. The Windows Biometric Service is enabled by default on any Windows installation with biometric hardware enrolled, which is increasingly common in enterprise laptops and workstations.

An attacker who has obtained a low-privileged shell or remote desktop session on a target Windows host - via phishing, credential theft, or another initial access vector - crafts a request to the Windows Biometric Service that triggers the heap overflow, overwriting heap metadata or function pointers to redirect execution. With no user interaction required and low attack complexity, the attacker executes arbitrary code as SYSTEM, gaining full control of the host and bypassing endpoint privilege boundaries.