Windows Biometric Service CVE-2026-83986

The attacker must hold an existing low-privileged local user account on the affected Windows system (CVSS PR:L). No network exposure of WBioSrvc is required; the attack surface is entirely local. The Windows Biometric Service must be running - it is enabled by default on consumer Windows installations and on Windows Server configurations where biometric authentication (Windows Hello for Business) is active. No special non-default configuration, elevated feature flag, or user interaction (UI:N) is required beyond authenticated local session access. Exploitation is strictly bounded to local privilege escalation: the AV:L metric confirms the vulnerability cannot be triggered remotely over a network. The primary limiting factor is the requirement for prior local access with at minimum a standard user account.

The CVSS 7.8 score accurately reflects a local privilege escalation with low attack complexity: an attacker holding a standard user account on the machine can reliably escalate to SYSTEM without user interaction or additional configuration prerequisites. While the AV:L vector means this is not remotely exploitable in isolation, local privilege escalation primitives are essential building blocks in post-exploitation chains - an organization that has suffered an initial access event via phishing, credential theft, or vulnerable internet-facing application is immediately exposed to full system takeover if endpoints are unpatched. No EPSS score was provided in the input data, and neither a CISA KEV listing nor public proof-of-concept code has been identified at time of analysis, so confirmed active exploitation cannot be asserted. However, given the ubiquitous deployment footprint of Windows across enterprise, government, and consumer environments globally, organizations should treat this as a standard-priority monthly patch - escalated to urgent if endpoint access controls are weak or if a concurrent initial-access vector is being tracked. The patch is available and the affected version ranges are precisely documented, making remediation straightforward with no ambiguity about target build numbers.

An attacker who has gained initial foothold on a Windows endpoint via phishing or credential theft - holding only a standard domain user account - invokes a crafted interaction with the Windows Biometric Service to trigger the heap overflow, corrupting heap control structures within the service process and redirecting execution to attacker-controlled code running as SYSTEM. With SYSTEM privileges, the attacker can disable endpoint defenses, extract credential material from LSASS, and pivot laterally through the environment. No public proof-of-concept has been identified at time of analysis, but the low attack complexity (AC:L) indicates the overflow condition is reliably triggerable once the trigger is known.