Windows Biometric Service CVE-2026-83975

Exploitation requires a local authenticated session with at least standard (non-administrative) user privileges on the target Windows system - the CVSS PR:L metric confirms this. No special configuration, non-default feature enablement, or specific hardware is described in the advisory as a prerequisite; however, the Windows Biometric Service must be running, which is its default state on Windows 10 and 11 systems and on Windows Server where the Biometric Framework feature is installed. Exploitation is constrained to local access (AV:L) - remote unauthenticated exploitation is not possible without first obtaining local execution (e.g., via RDP session or prior compromise). The limiting factor is the requirement for an authenticated local foothold; this makes the vulnerability most relevant as a second-stage privilege escalation payload rather than an initial access vector.

CVSS 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H places this squarely in the high-severity LPE category: low-privilege local access is sufficient, no interaction is needed, and full system compromise results. The attack complexity is low, meaning no race conditions or precise heap feng shui is described by Microsoft - exploitation may be relatively straightforward once an attacker has a foothold. No EPSS data was provided in the input; given the absence of a KEV listing and no known public POC, real-world exploitation probability is currently low-to-moderate. However, LPE vulnerabilities in widely deployed Windows services are historically favored as second-stage payloads in post-compromise scenarios (ransomware, targeted intrusion), so the risk is materially higher in environments where endpoint security relies on user-level containment. The breadth of affected versions - spanning five years of Windows releases - amplifies enterprise exposure. The CVSS score accurately reflects the attack mechanics; no metric appears overstated given the description.

An attacker who has already gained a low-privileged user session on a Windows endpoint - for example via phishing, credential stuffing, or exploitation of a separate vulnerability - sends a crafted request to the Windows Biometric Service's local IPC endpoint. The malformed input triggers the heap overflow, corrupting adjacent heap metadata or a function pointer within the WbioSrvc process. The attacker redirects execution to shellcode or a ROP chain that spawns a SYSTEM-level shell, completing the privilege escalation. No public POC exists at time of analysis, but the low attack complexity rating suggests the technique does not require advanced heap manipulation.