Windows Biometric Service CVE-2026-83980

The attacker must hold an existing low-privileged local account on the target Windows system (PR:L). The Windows Biometric Service must be running, which is the default state on Windows installations that support Windows Hello biometric authentication - no non-default configuration or biometric hardware enrollment is required to trigger the service. No user interaction is needed. Limiting factors include the requirement for prior local code execution (AV:L), meaning remote-only attackers cannot directly exploit this without a separate initial access vector. The vulnerability is not constrained to any specific Windows edition or feature set beyond the service being in its default running state.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a reliable local privilege escalation: low-complexity, no user interaction, and full C/I/A impact. The low attack complexity means exploitation is not gated by race conditions or unusual heap states; once a local foothold is established, this is a straightforward escalation path to SYSTEM. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog at time of analysis, suggesting no confirmed widespread exploitation - but the ubiquity of Windows endpoints means even a mid-sized municipal IT team in boleslawiec should treat this as urgent patching work. SSVC assessment: exploitation status 'none publicly known,' automatable 'no' (requires prior local access), technical impact 'total' - priority is 'attend' for organizations with a rapid patch cadence and 'act' for those with extended patch cycles or high-value endpoints. The absence of a public POC moderates immediate urgency, but the low AC:L combined with high impact makes weaponization straightforward once primitives are understood.

An attacker who has already compromised a low-privileged domain or local account on a Windows endpoint - for example, via phishing or lateral movement - runs a crafted payload targeting the Windows Biometric Service to trigger the heap overflow. The corruption of heap metadata allows redirection of execution into attacker-controlled shellcode running in the service's SYSTEM context, granting complete administrative control over the host. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates the overflow condition is reliably triggerable.