Windows Biometric Service EUVD-2026-73140

Exploitation requires an attacker to already hold a valid low-privileged local user account on the target system (confirmed by PR:L in the CVSS vector). The Windows Biometric Service must be running, which is the default state on Windows installations configured with biometric hardware support; no non-default configuration is required to reach the vulnerable code path. Attack vector is strictly local (AV:L), meaning no network access is sufficient on its own-the attacker must have an interactive or remote desktop session on the host. No user interaction is required (UI:N) beyond the attacker's own actions. The primary limiting factor for defenders is the local-access prerequisite: this vulnerability is not exploitable from the network directly, and is most relevant as a privilege escalation step in a multi-stage intrusion chain or by a malicious insider.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) accurately reflects a post-exploitation local privilege escalation scenario: an attacker must already hold a low-privileged account but faces no additional complexity barriers, no required user interaction, and achieves full system compromise upon success. The AC:L rating is the critical signal here-it implies exploitation does not require race conditions, specific timing, or complex heap-grooming sequences that would be operationally unreliable. This makes the vulnerability a reliable second-stage tool for attackers who have gained initial footholds via phishing or credential theft. The scope is unchanged (S:U), meaning compromise does not automatically pivot to adjacent systems, containing blast radius to the local host. No KEV listing exists and no EPSS data was provided, so widespread opportunistic exploitation is not confirmed; however, the broad affected surface (15 distinct Windows versions across client and server) and low exploitation complexity elevate this above a typical 7.8. Priority should be high for any environment with untrusted local users or post-breach lateral movement risk.

An attacker who has compromised a standard user account-via phishing, credential stuffing, or lateral movement from another host-submits malformed biometric API requests to the locally running Windows Biometric Service. The crafted input overflows a heap buffer, allowing the attacker to corrupt adjacent memory and redirect execution within the privileged service process, yielding SYSTEM-level code execution without requiring any interaction from another user. No public proof-of-concept has been identified at time of analysis, but AC:L suggests reliable exploitation is achievable for a skilled threat actor.