Windows Biometric Service EUVD-2026-73258

The attacker must hold a valid low-privileged local Windows account (PR:L) capable of executing code on the target system - a domain user, a local user account, or any other standard session suffices. No elevated privileges, no specific biometric hardware present, and no victim user interaction (UI:N) are required. Windows Biometric Service must be in a running state; on consumer endpoints and systems enrolled in Windows Hello for Business this is the default. On servers where biometric features have been explicitly disabled and the service stopped or set to Disabled startup, exploitability is reduced but only while the service remains stopped. The vulnerability affects default-configured systems across all fifteen listed version/edition combinations, with no non-default configuration prerequisite identified in the available advisory data.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a reliable local privilege escalation requiring no special conditions beyond a standard user account. EPSS data is not provided in the available intelligence, and this vulnerability is not listed in CISA KEV, meaning no confirmed widespread exploitation has been established at time of analysis. Despite the absence of a known exploit, the low attack complexity (AC:L) means a skilled researcher could construct a working exploit from Microsoft's patch differential without undue difficulty, making the effective exploitation window narrow once patches are applied. The breadth of affected versions - fifteen distinct Windows 10, Windows 11, and Windows Server edition/build combinations spanning Server 2016 through Server 2025 - significantly expands the aggregate attack surface, and even a mid-sized municipal IT team in koszalin operating a mixed Windows Server estate should treat this as urgent given how broadly Windows Biometric Service is enabled by default. Post-exploitation value is high: SYSTEM-level access unlocks credential dumping, lateral movement, and persistence mechanisms that underpin most advanced intrusion playbooks.

A domain user or compromised service account with a standard low-privileged Windows session on a target endpoint or server sends a crafted interaction to the Windows Biometric Service. The malformed input triggers the heap-based buffer overflow within the privileged WinBio process, allowing the attacker to corrupt adjacent heap structures and redirect code execution. The attacker's session is elevated to NT AUTHORITY\SYSTEM, enabling credential dumping, persistence installation, or lateral movement across the network. No public exploit code exists at time of analysis, but the AC:L rating indicates the exploit primitive is accessible without complex prerequisite state.