Windows Biometric Service CVE-2026-83988

Exploitation requires a locally authenticated session with at least standard user (low-privileged) access on the target system, as confirmed by the CVSS PR:L metric; the Windows Biometric Service must be running, which is its default state on systems with biometric hardware support enabled. No interaction from a second user or victim is required (UI:N). Remote unauthenticated exploitation is not possible - the AV:L metric constrains the attack to local access only (physical console, RDP session, or similar authenticated local context). The scope is unchanged (S:U), meaning exploitation is contained to privilege escalation within the WBioSrvc process boundary on the local system and does not directly compromise adjacent systems. Systems where the Biometric Service has been administratively disabled or where no biometric hardware is present may have reduced exposure, though this has not been independently confirmed as a complete mitigation.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a high-impact local privilege escalation with low attack complexity - once an attacker has any user-level foothold, this class of vulnerability is routinely chained as the second stage in broader intrusion campaigns. No EPSS data was provided, but local EoP bugs in widely-deployed Windows services historically attract rapid exploit development, often within two to four weeks of patch release, as reverse engineers diff the patched and unpatched binaries to reconstruct the vulnerability. No public exploit code and no CISA KEV entry exist at time of analysis, making this currently a patch-and-wait scenario rather than an emergency break-glass response; even so, even a mid-sized municipal IT team in tczew should treat this as urgent given how frequently such local EoP flaws are chained with phishing-derived initial access in ransomware and APT intrusion chains. The broad Windows footprint - covering essentially every supported Windows 10/11 desktop and Server edition - means near-universal enterprise exposure, and the AC:L rating indicates no special memory layout or timing conditions are required once the overflow primitive is identified.

An attacker who has established a low-privileged user session on a target Windows host - via phishing, credential stuffing, or as an insider threat - calls the Windows Biometric Service API with a crafted malformed request designed to overflow a heap buffer in the WBioSrvc process. The overflow corrupts adjacent heap memory, allowing the attacker to overwrite a function pointer or heap metadata structure and redirect execution into attacker-controlled code running under the SYSTEM context of WBioSrvc. No public proof-of-concept has been identified, but the AC:L rating indicates exploitation requires no special heap-spray timing or environment-specific conditions beyond constructing the overflow payload.