Windows Biometric Service CVE-2026-83976

Exploitation requires an authenticated local user account (PR:L per CVSS vector) - no network-facing exposure exists (AV:L). The Windows Biometric Service (WBioSrvc) must be running on the target system; it is enabled by default on Windows 10 and Windows 11 consumer and enterprise editions, and on Windows Server editions where biometric enrollment is configured. No additional user interaction is required (UI:N) beyond the attacker's own crafted input. Limiting factors: attack is strictly local (AV:L), requiring prior foothold on the target system through another vector; systems where WBioSrvc has been explicitly stopped and disabled via Group Policy or service management are not exploitable; no network-facing attack path exists independently of this vulnerability.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N accurately characterizes a local privilege escalation with no special complexity - once an attacker has any foothold on a machine, exploitation is straightforward. Full CIA impact (C:H/I:H/A:H) reflects escalation to SYSTEM, providing unrestricted control of the local machine. The unchanged scope (S:U) limits blast radius to the compromised host, but LPE-to-SYSTEM is typically the final step in post-exploitation chains used in ransomware and advanced persistent threat operations. No public proof-of-concept code exists and the vulnerability does not appear in CISA KEV, keeping immediate opportunistic risk moderate; however, AC:L means skilled attackers will reach reliable exploitation quickly once they invest in analysis. EPSS data was not provided in available intelligence. The sheer breadth of affected builds - spanning Windows 10 through Windows 11 26H1 and Server 2016 through Server 2025 - means nearly every unpatched Windows environment in production is exposed, and even a mid-tier enterprise IT team should treat this as a standard patch-cycle priority rather than a low-urgency backlog item.

A low-privileged attacker with a local user account - for example, malware already executing in user context or a malicious insider - sends a crafted request to the Windows Biometric Service that triggers the heap buffer overflow, overwriting heap control structures or a function pointer. The attacker redirects service execution to shellcode or a ROP chain, spawning a SYSTEM-level shell or injecting code into a privileged process. No public proof-of-concept code is known at time of analysis, but the AC:L rating indicates the exploitation path does not require race conditions or memory layout brute-forcing once the overflow primitive is understood.