Windows Hello EUVD-2026-73072

Exploitation requires a valid low-privileged local Windows account (PR:L per CVSS) and local access to an affected Windows 11 system (AV:L) - interactive logon or an existing low-privilege session both qualify. No user interaction from another user is required (UI:N), and no special Windows Hello configuration, non-default feature flag, or specific biometric hardware enrollment is specified as a prerequisite in the available description. Remote unauthenticated exploitation is not possible. The limiting factors are physical or remote-session local access (e.g., RDP) and possession of any valid Windows account, even a standard unprivileged domain or local account. Systems running fixed builds (10.0.22631.7582+, 10.0.26100.9445+, 10.0.26200.9445+, 10.0.28000.2954+) are not affected.

The CVSS 8.8 score is driven by S:C (security boundary crossing) plus full C:H/I:H/A:H impact in the elevated context, with only PR:L required and no user interaction needed. This profile - AC:L/PR:L/UI:N on one of the most widely deployed desktop operating systems - makes exploitation reliable once a local foothold is established, positioning this as a high-priority second-stage tool in post-compromise attack chains. The vulnerability is not in CISA KEV and no EPSS value was provided in the input, so mass-exploitation is not confirmed; however, absence from KEV should not be interpreted as low urgency on a platform of this deployment scale. The 'Denial of Service' tag in the source metadata conflicts with the described impact - Microsoft's own description specifies privilege escalation, and DoS is not the primary classified impact; this is a mislabeled metadata issue, not a CVSS scoring conflict. The A:H component in the vector may reflect a crash-as-side-effect scenario, but the defining impact is EoP. Patch availability is confirmed by Microsoft.

An attacker who has achieved a low-privileged local session - for example through phishing-delivered malware or exploitation of a separate initial-access vulnerability - interacts with the Windows Hello authentication component to trigger a use-after-free condition. By controlling the contents of the freed memory region before it is dereferenced, the attacker redirects execution within the privileged Windows Hello service or kernel component, achieving SYSTEM-level code execution. No public proof-of-concept has been identified at time of analysis, but the AC:L/UI:N/PR:L vector makes this straightforward to operationalize for a skilled attacker following initial access.