Windows Biometric Service EUVD-2026-73141

Exploitation requires a locally authenticated session on the target with at minimum standard (low-privilege) user rights, consistent with the CVSS vector AV:L/PR:L. The Windows Biometric Service must be running - it starts automatically by default on systems configured with biometric hardware (Windows Hello fingerprint or face recognition). No additional non-default configuration is required beyond a valid user account. Remote exploitation is not possible per the AV:L vector; an attacker must first establish local code execution through another means (e.g., RDP session with valid credentials, a separate initial-access exploit, or physical access). Server SKUs without biometric hardware may have WinBioSrvc disabled or absent, which would limit exposure on headless server deployments - this should be verified per environment.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U accurately captures the threat model: local access with standard user rights, no complex preconditions, no user interaction needed, and full system compromise (C:H/I:H/A:H). The 7.8 score is well-calibrated. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. However, local privilege escalation primitives in Windows system services are a staple of post-exploitation tooling - they are routinely incorporated into ransomware deployment chains and APT playbooks where initial access is already established via phishing or a separate exploit. The unusually broad affected scope (15 distinct product/version/SKU combinations spanning Windows 10 through Windows Server 2025) substantially increases the aggregate number of exploitable endpoints. Attack complexity is genuinely low once local presence is achieved, making this a reliable privilege escalation step. SSVC automatable dimension is No for initial access (requires local foothold), but the technical impact is rated Total on the vulnerable system.

An attacker who has obtained a standard user shell on a target Windows system - for example, via a phishing-delivered payload or a credential compromise - sends a specially crafted request to the Windows Biometric Service over its local IPC endpoint, triggering the heap buffer overflow in WinBioSrvc. By controlling the overflow to corrupt adjacent heap control structures or a function pointer, the attacker redirects execution into their payload, achieving SYSTEM privileges. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) and lack of user-interaction requirement make this a practical and reliable privilege escalation primitive in a post-exploitation chain.