Windows Biometric Service CVE-2026-83977

Requires an existing low-privileged authenticated local session on the target Windows system (PR:L). The Windows Biometric Service (WbioSrvc) must be running, which is the default state on all Windows versions that ship with Windows Hello support. No biometric hardware needs to be physically present - the service runs regardless. No user interaction is required beyond establishing the initial low-privilege session. Exploitation is constrained to local attack vector (AV:L), meaning network-only access is insufficient; the attacker must be able to execute code on the target host. Remote exploitation is only feasible as the second stage of an exploit chain (e.g., after RCE via a different vulnerability, or in an RDP/VDI multi-user scenario where low-privileged remote desktop sessions are permitted).

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N reflects a straightforward local privilege escalation: low-privilege shell access is the only prerequisite, and exploitation complexity is rated low. No EPSS score was provided in the input data; no CISA KEV listing is present, and no public proof-of-concept exploit is identified at time of analysis. Despite the absence of KEV/POC signals, the low attack complexity combined with the breadth of affected Windows versions (desktop and server) makes this a meaningful threat in environments where untrusted local code execution is possible - shared infrastructure, VDI, RDP multi-tenant, or any post-initial-access scenario. The full C:H/I:H/A:H impact triad is consistent with privilege escalation to SYSTEM. Organizations relying solely on CVSS for prioritization should treat this as high priority on widely accessed server workloads; on single-user endpoints with managed access the practical risk is reduced.

An attacker who has gained initial foothold on a Windows system with a low-privileged user account - for example, via phishing, a vulnerable application, or stolen credentials - calls into the Windows Biometric Service IPC interface with a malformed request that triggers the heap overflow, corrupting service heap memory to redirect execution to attacker-controlled code running as SYSTEM. No public exploit code is known at time of analysis, but the low attack complexity rating suggests the vulnerability is exploitable without significant research effort once discovered.