Windows Biometric Service CVE-2026-83978

Exploitation requires an authenticated local session with at minimum standard-user (low) privileges on the target Windows system, consistent with the CVSS PR:L/AV:L vector. The Windows Biometric Service (WbioSrvc) must be in a running state; it starts automatically by default on Windows 10 and Windows 11 client systems, particularly those with biometric hardware, but may be present and running on server builds as well depending on configuration. No network positioning is required - the attacker must have interactive console or Remote Desktop Protocol (RDP) access to the target. The primary factors limiting exploitation are: the requirement for a valid low-privilege account (excludes fully unauthenticated attackers); the need for local/RDP session access (excludes pure network-based exploitation); and the AV:L constraint (excludes lateral movement without prior foothold). This makes the vulnerability most relevant in post-compromise privilege escalation chains, insider threat scenarios, shared multi-user environments (terminal servers, VDI pools, kiosk systems), and environments where standard user workstations have biometric readers configured.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a local privilege escalation that requires only a standard user account and no user interaction, making it directly relevant in shared workstation, VDI, kiosk, and terminal server scenarios - even a mid-sized municipal IT team in rybnik should treat this as urgent given the breadth of affected Windows versions deployed across their endpoint fleet. The AC:L rating is notable: it indicates that exploitation does not require precise timing, a specific heap state, or information leaks as preconditions, which lowers the practical barrier for an attacker who already holds local access. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. The CVE is not in CISA KEV and no public exploit code has been identified, placing real-world exploitation risk below KEV-listed vulnerabilities of similar CVSS weight. However, the combination of AV:L, AC:L, and PR:L means that any post-compromise scenario (phishing-gained foothold, insider threat, unsupervised workstation) converts directly into full SYSTEM access. The patch breadth - fifteen affected build configurations across both client and server lines - confirms this is a systemic issue in shared WBF code rather than an isolated edge-case regression.

An attacker with a standard low-privilege domain or local account on an unpatched Windows system authenticates interactively or via RDP, then submits crafted input through the Windows Biometric Framework IPC interface targeting WbioSrvc. The malformed payload triggers a heap buffer overflow within the privileged service process, corrupting adjacent heap structures and redirecting execution to attacker-controlled shellcode. The attacker emerges with SYSTEM-level privileges and full control of the target host; no public exploit code is known at this time, but the AC:L vector indicates that heap-state preconditions are not required for successful exploitation.