Windows Biometric Service CVE-2026-83985

Exploitation requires the attacker to already hold a valid local user account on the target system (PR:L - low-privileged OS-level access). The Windows Biometric Service must be running, which is the default state on all modern Windows client and server installations unless explicitly disabled by policy. No network access, no specific non-default configuration, and no user interaction are required beyond local user authentication. What limits exploitation: the attacker must have local code execution first - this is a privilege-escalation primitive, not an initial-access vector. Remote exploitation is not possible with this vector (AV:L). Environments that have disabled the Windows Biometric Service or restricted access to the WinBio API surface reduce (but do not eliminate) exposure.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately characterizes this as a local privilege escalation requiring only standard user access (PR:L) with low attack complexity. The description's explicit phrase 'authorized attacker' aligns with PR:L. No EPSS score was supplied, no KEV listing exists, and no public POC has been identified - these signals together suggest this is not being actively exploited at scale. However, the low complexity (AC:L) and lack of any non-default configuration requirement make this a credible post-exploitation tool: any actor who gains a foothold as a standard user on any patched Windows host can reliably escalate to SYSTEM. The broad affected surface (Windows 10/11 and all Server variants from 2016 to 2025) substantially widens deployment exposure. Real-world prioritization should be driven by whether Windows Biometric Service is running in the environment (it is enabled by default on consumer and enterprise Windows), making this a meaningful lateral-movement / privilege-escalation risk following initial access.

An attacker who has already gained a low-privileged shell on a Windows host - through phishing, credential theft, or a prior exploit - invokes the Windows Biometric Framework API to submit a specially crafted request that triggers the heap buffer overflow in the Windows Biometric Service (running as SYSTEM). The overflow corrupts heap metadata or a function pointer within the service's heap, redirecting execution to attacker-controlled code, resulting in a fully elevated SYSTEM shell. No public POC has been identified, but AC:L indicates the overflow is reliably triggerable without extensive heap-grooming.