Windows Biometric Service CVE-2026-83983

The attacker must hold an authenticated local user session on the target system (PR:L) - no administrative rights are required. The Windows Biometric Service (wbiosrvc) must be running, which is the default configuration on Windows systems where biometric hardware (fingerprint reader, IR camera for Windows Hello) is present or where Windows Hello has been configured. No user interaction is required (UI:N) and no complex race conditions or special configurations are needed (AC:L). Exploitation is strictly limited to local access - the AV:L vector confirms remote network exploitation is not possible. Disabling the Windows Biometric Service or Windows Hello removes the attack surface for systems where biometric authentication is not required.

The CVSS 7.8 High rating accurately reflects a reliable local privilege escalation reachable by any standard authenticated user. AC:L with no complex conditions or race requirements makes this a stable escalation primitive rather than an opportunistic one. The unchanged scope (S:U) constrains blast radius to the compromised host, but C:H/I:H/A:H means full SYSTEM-level control once exploited. The affected-version matrix is exceptionally broad - spanning Windows 10 Version 1607 through Windows 11 26H1 and four Windows Server generations including Server 2025 - placing this vulnerability in virtually every enterprise Windows fleet. No EPSS score is supplied in the input data; KEV status is not confirmed. No public exploit code has been identified. Despite the absence of confirmed active exploitation, the straightforward exploitation conditions and near-universal Windows deployment make this a high-priority patch for any environment where untrusted users may obtain local sessions (e.g., shared workstations, VDI, RDP endpoints). The biometric service's privileged execution context makes it a valuable post-initial-access escalation target in intrusion chains.

An attacker who has achieved an initial low-privileged foothold on a Windows system - for example, via a phishing-delivered payload or web browser exploit - crafts a malformed request to the Windows Biometric Service through its local RPC or API interface, triggering the heap buffer overflow in wbiosrvc. Corrupted heap memory redirects execution within the privileged service process, granting the attacker SYSTEM-level code execution. No public exploit code exists at time of analysis, but the low attack complexity and broad version coverage make this an attractive escalation step in multi-stage intrusion chains.