Windows Biometric Service EUVD-2026-73750

Exploitation requires an authorized local attacker with at minimum low-privilege code execution on the target system (PR:L per CVSS). The Windows Biometric Service must be running - it is active by default on consumer Windows 10/11 systems with biometric hardware or Windows Hello configured, but is frequently disabled or absent on hardened server SKUs without biometric devices. No network access or remote vector exists (AV:L); this is a strictly local attack. No user interaction is required (UI:N). The primary limiting factor is the prerequisite of prior local code execution - an attacker must already have a foothold on the machine before this vulnerability can be leveraged. Exploitation does not cross a scope boundary (S:U), meaning SYSTEM privileges gained remain local and do not directly yield lateral movement without additional tooling.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the risk posture: low-privilege local code execution is the only prerequisite, attack complexity is low, and full system compromise results. The breadth of affected SKUs - 15 distinct Windows build branches from consumer to datacenter - dramatically amplifies aggregate exposure; even a modest IT operation running mixed Windows 10 and Windows Server infrastructure should treat patching as urgent rather than routine. No CISA KEV listing is present in the provided data, and no EPSS score was supplied, so active exploitation cannot be confirmed. However, local privilege escalation in Windows system services has historically been operationalized rapidly as second-stage payloads in ransomware and APT toolchains once initial access is established. The low complexity and absence of any user interaction requirement (UI:N) make this an attractive post-exploitation primitive once a foothold is gained. No public PoC has been identified at time of analysis, which moderates near-term risk, but the straightforward attack path warrants prompt patch deployment rather than waiting for exploitation evidence.

An attacker who has achieved low-privilege code execution on a Windows endpoint - via phishing lure, credential theft, or initial-access malware - sends crafted input to the locally accessible Windows Biometric Service interface to trigger the heap buffer overflow. With AC:L and no user interaction required, the attacker reliably corrupts heap structures within the elevated WinBioSrvc process to redirect execution and obtain SYSTEM-level privileges. No public PoC has been identified at time of analysis, but the straightforward local attack path and low complexity make this a natural second-stage escalation primitive following initial foothold establishment.