Windows Biometric Service EUVD-2026-73705

The attacker must hold a valid low-privilege local account on the target Windows system (PR:L per CVSS vector) - remote unauthenticated exploitation is not possible. The exploit requires the Windows Biometric Service (WbioSrvc) to be running; on systems without configured biometric hardware or where the service has been manually disabled, exploitation is blocked. No specific biometric device needs to be enrolled - the service itself is the attack surface. No user interaction is required beyond the attacker's own session. The attack is limited to local privilege escalation (S:U, scope unchanged); lateral movement or remote exploitation requires additional steps beyond this CVE.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a local privilege escalation with low attack complexity and no user interaction required beyond holding a standard user account. The low-privilege requirement (PR:L) is the primary limiting factor - the attacker must already have an authenticated local session or be able to run code on the target. EPSS data is not provided, and the CVE is not listed in CISA KEV, meaning active exploitation is not confirmed. No POC has been identified. Despite these factors, the severity is real: LPE vulnerabilities in core Windows services are routinely chained with initial-access exploits (phishing, drive-by) to achieve full system compromise. The breadth of affected versions - spanning over a decade of Windows releases from Server 2016 through the latest Windows 11 26H1/25H2 builds - substantially increases exposure. Microsoft's own security reporting address (secure@microsoft.com) indicates this was discovered through internal research or coordinated disclosure, not observed exploitation.

An attacker who has gained an initial foothold on a Windows endpoint - for example via a phishing-delivered payload executing as a standard user - calls the Windows Biometric Service API with a malformed request crafted to overflow a heap buffer in WbioSrvc. The overflow corrupts adjacent heap structures, enabling the attacker to redirect execution within the service's privileged context and obtain SYSTEM-level code execution, completing a two-stage initial-access-plus-LPE compromise chain. No public proof-of-concept code has been identified at time of analysis.