Windows Biometric Service CVE-2026-83982

The attacker must hold an authenticated local user session on the target Windows machine with at least standard (low-privilege) access - corresponding to CVSS PR:L. Windows Biometric Service (WbioSrvc) must be running on the target; this is the default state on machines configured with Windows Hello, fingerprint readers, or facial recognition hardware. The attack vector is strictly local (AV:L): a remote-only attacker with no existing foothold on the machine cannot directly exploit this vulnerability. No user interaction from a privileged account is required (UI:N), and no special hardware enrollment state is described as a prerequisite. Exploitation is therefore constrained to: (1) an attacker with a valid local session, and (2) WbioSrvc in its default running state.

The CVSS 7.8 High score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately represents this as a reliable local privilege escalation - low complexity, no user interaction, and full system compromise once triggered. The AC:L rating is particularly significant: it implies the overflow is consistently triggerable without race conditions or complex heap-grooming, making exploitation predictable for any attacker who already holds a local foothold. No public POC code and no CISA KEV listing have been identified in the provided data, which moderates immediate urgency compared to actively exploited issues, but the breadth of affected versions - spanning every supported Windows client and server release - means that even a mid-sized IT team operating endpoints across multiple Windows generations should treat this as urgent patching work rather than a deferred item. The S:U (unchanged scope) metric correctly reflects that exploitation is contained to the compromised host rather than pivoting to adjacent systems; however, achieving SYSTEM on any domain-joined machine materially enables further lateral movement and credential theft. EPSS data was not provided in the input and cannot be assessed.

A standard domain user on a Windows workstation - for example, a helpdesk account or a compromised employee credential - crafts a malformed biometric service request that overflows a heap buffer in WbioSrvc. With AC:L confirming no complex setup is needed, the overflow reliably corrupts heap control structures, redirecting execution to attacker-controlled code running as SYSTEM. From SYSTEM, the attacker can dump LSASS credentials, install a persistent implant, or pivot across the domain. No public proof-of-concept code has been identified at time of analysis.