Windows Biometric Service EUVD-2026-73689

Requires an active, authenticated local user session on the target Windows system (PR:L); remote unauthenticated exploitation is not possible given AV:L. Windows Biometric Service must be running, which is the default state on consumer and enterprise Windows installs where Windows Hello biometric features are configured. No special software installation, administrative privilege, or non-default configuration beyond standard user access is required. Exploitation is limited to the local machine scope (S:U); lateral movement to other hosts is not a direct consequence of this vulnerability alone. The vulnerability affects only the listed Windows versions - endpoints already patched to or above the fixed build numbers are not vulnerable.

The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a reliable local privilege escalation requiring only a standard user session. Attack complexity is low - no race condition or unusual precondition is documented - and no user interaction is required once the attacker has local execution. The sheer breadth of affected versions (15 distinct product builds from Windows 10 1607 through Windows Server 2025) greatly amplifies the aggregate exposure; even a mid-sized municipal IT team managing a mixed OS estate should treat patching here as urgent given how broadly Windows Biometric Service is enabled by default. EPSS data was not provided in the source intelligence; no CISA KEV listing is confirmed, and no public exploit code has been identified, placing this at moderate-to-high deployment priority rather than emergency triage. The vendor (Microsoft MSRC) has issued a patch, reducing dwell-time risk for patched environments significantly.

An attacker with a low-privileged local user account on a Windows endpoint - for example, a shared workstation or a post-phishing foothold - sends a crafted input to the Windows Biometric Service via the WinBiometric Framework API, triggering a heap buffer overflow that corrupts service memory and redirects execution to attacker-controlled shellcode running as SYSTEM. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of any required user interaction suggest the overflow is reliably triggerable once an attacker understands the vulnerable code path.