Windows Biometric Service CVE-2026-83974

Exploitation requires an authenticated local session with at least standard user (non-administrator) privileges on the target Windows system - CVSS PR:L confirms this. The Windows Biometric Service must be running, which is the default state on Windows 10 and 11 systems with biometric hardware support and on Windows Server builds where the feature has been enabled. No network exposure is involved; exploitation cannot be performed remotely unless the attacker first achieves local code execution through another vector. Limiting factors: AV:L restricts this to users or processes already present on the system; UI:N means no administrator or other user action is required after initial access; S:U means the overflow does not escape the local machine context to affect other systems directly.

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U accurately characterizes this as a reliable local privilege escalation with no complexity barrier once local access is established. The local attack vector (AV:L) is the primary risk limiter - exploitation requires an existing foothold on the target machine, meaning this vulnerability is most dangerous as a second-stage component in a broader attack chain (e.g., following phishing or an initial-access exploit). No EPSS score was provided in the input data; no CISA KEV listing exists at time of writing, indicating no confirmed active exploitation. The low attack complexity (AC:L) and no required user interaction (UI:N) mean that once an attacker has a low-privilege shell, privilege escalation is straightforward and automatable. The breadth of affected Windows versions - spanning five years of releases and both client and server SKUs - means exposure is wide across enterprises that have not yet applied the patch. Organizations with endpoint detection controls monitoring for unexpected WbioSrvc interactions or heap-spray patterns may partially mitigate exploitation risk prior to patching.

An attacker who has obtained a low-privilege user shell on a Windows machine - via phishing, web exploit, or credential theft - sends a specially crafted request to the Windows Biometric Service, triggering a heap overflow that corrupts service memory structures. The attacker leverages this corruption to redirect execution and escalate to SYSTEM, enabling them to install persistent backdoors, dump credential hashes from LSASS, or disable endpoint security tools. No public exploit code has been identified, but the AC:L rating suggests the overflow is mechanistically straightforward to exploit once the triggering input is determined.