Windows Biometric Service CVE-2026-83973

Requires an authenticated local session with at least standard user (low) privileges - PR:L in CVSS confirms this. The Windows Biometric Service must be running, which is the default state on Windows 10/11 consumer editions with Windows Hello configured; it may be disabled on hardened server builds or in environments that have explicitly disabled biometric authentication via Group Policy. No network access is required (AV:L). No user interaction is needed (UI:N). Exploitation is limited to the local machine - this is not directly remotely exploitable without a prior foothold. Attackers must be locally logged in or have code execution in an existing low-privilege process.

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a well-understood LPE class: low-privilege local user executes exploit, gains SYSTEM. Attack complexity is rated Low, meaning no race condition or bypass is needed beyond delivering the malformed payload. This is a post-authentication, local-only vector, significantly limiting remote mass exploitation. No CISA KEV listing and no public POC have been identified, placing real-world exploitation risk in the opportunistic/targeted range rather than mass exploitation. However, Windows is ubiquitously deployed and LPE primitives are high-value components in post-exploitation chains - an attacker who achieves any foothold (phishing, RCE in a lower-privileged app) would benefit from this to reach SYSTEM. The patch is available; organizations with mature patch cadences will close this window quickly.

An attacker who has compromised a standard user account on a Windows workstation - for example, via a phishing document executing a low-privilege shell - calls the Windows Biometric Service's local COM interface with a malformed biometric data structure, triggering the heap overflow. The corrupted heap metadata redirects execution to attacker-controlled shellcode running in the WbioSrvc process context (SYSTEM), yielding full control of the endpoint. No public POC has been identified, but the low attack complexity (AC:L) rating implies no significant technical barrier once an initial local foothold exists.