Windows Biometric Service CVE-2026-83987

The attacker must have low-privilege code execution on the target Windows system - a standard user session or equivalent unprivileged process context satisfies this requirement (PR:L). No special biometric hardware needs to be installed; the Windows Biometric Service runs as a default automatic-start service regardless of whether physical sensors are present. No user interaction is required (UI:N) and no non-default configuration is specified. The primary limiting factor is that initial local code execution must already exist - this is a privilege escalation, not an initial access vector. Exploitation is constrained to the local machine scope (S:U); it does not directly enable lateral movement to adjacent systems.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a meaningful local privilege escalation path. The attack complexity is low and no user interaction is needed once the attacker has a low-privilege foothold, making this a reliable post-exploitation tool for lateral movement or sandbox/container escape in environments where Windows Biometric Service is reachable. No EPSS data was provided, and neither KEV status nor public exploit code is confirmed - these are the primary moderating factors reducing urgency compared to similar network-exposed LPEs. However, the extraordinary breadth of affected versions (Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025) means virtually every unpatched Windows estate in production is affected. The principal real-world risk scenario is chaining this after initial access via phishing or a web exploit to achieve full SYSTEM compromise. The scope metric S:U is consistent with Microsoft's scoring; privilege escalation here elevates within the same OS instance rather than jumping to adjacent systems. Overall, this is a credible, reliably exploitable LPE on a default component - treat as high priority for patch deployment despite the absence of confirmed public exploitation.

An attacker who has established a low-privilege foothold on a Windows system - for example, via a phishing-delivered dropper running as a standard user - crafts a malformed biometric service request that triggers a heap buffer overflow in WbioSrvc. By controlling heap layout, the attacker overwrites a function pointer or heap metadata to redirect execution into attacker-controlled shellcode, achieving SYSTEM-level code execution and completing a full privilege escalation chain. No public exploit code is confirmed, but the low attack complexity (AC:L) suggests reliable exploitation once heap offsets are characterized.