Windows Biometric Service CVE-2026-83979

The attacker must already have code execution as a low-privileged local user (PR:L, AV:L) - remote unauthenticated exploitation is not possible per the CVSS vector. The Windows Biometric Service must be running, which is the default state on Windows 10 and Windows 11 when biometric hardware is present or the service has not been explicitly disabled. No additional non-default configuration is required beyond having a standard user account. Exploitation is not gated by user interaction (UI:N) and attack complexity is Low (AC:L), suggesting the memory-corruption primitive does not rely on a race condition or heap-layout prerequisite.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) accurately reflects the threat model: the attacker must already have local code execution as a low-privileged user, which gates the attack behind an initial access step. Attack complexity is rated Low, suggesting the memory-corruption primitive is reliable rather than race-condition dependent. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog at time of analysis. No public exploit code is known. Despite the absence of observed active exploitation, the ubiquitous deployment footprint of Windows, the low post-foothold bar (PR:L/AC:L), and the full C:H/I:H/A:H impact make this a high-priority patch for endpoints where privilege escalation by local users is a concern - particularly shared workstations, VDI environments, and servers accessible to multiple accounts. The 'Denial Of Service' tag in the source metadata is potentially mislabeled: the vulnerability is an EoP whose primary exploited impact is privilege escalation, not service disruption, though a failed exploitation attempt could crash the WBS process.

An attacker who has already obtained a low-privileged interactive or remote session (e.g., via phishing or credential theft) on a targeted Windows endpoint crafts a sequence of API calls or requests directed at the Windows Biometric Service that triggers the use-after-free condition, corrupting the freed memory region with attacker-controlled data. The attacker's payload redirects WBS execution to shellcode or a privileged operation, elevating their session from standard user to SYSTEM and enabling installation of persistence mechanisms, credential harvesting, or lateral movement.