Windows Biometric Service EUVD-2026-73751

Exploitation requires an existing low-privilege authenticated account on the target Windows system (CVSS PR:L confirmed). No elevated rights, no special configuration, and no user interaction beyond the attacker's own actions are needed. The Windows Biometric Service must be running, which is the default state on Windows systems where biometric hardware (fingerprint readers, IR cameras for Windows Hello) is present or configured. On systems where biometrics are disabled via Group Policy or where the service is stopped, the attack surface is reduced. No network accessibility is required - exploitation is strictly local (AV:L).

The CVSS 7.8 score correctly captures the local-only attack surface (AV:L, PR:L), which limits network-based mass exploitation but does not reduce real-world severity once an attacker has any foothold on a target system. Low attack complexity (AC:L) and no user interaction (UI:N) mean that post-access privilege escalation is reliable and scriptable - even a mid-sized municipal IT team in boleslawiec should treat this as urgent given the breadth of affected Windows builds. No CISA KEV listing and no public exploit have been identified, which lowers immediacy somewhat, but the ubiquitous deployment of affected Windows versions and the reliable exploit path mean that patch prioritization should be high for any environment where untrusted or compromised user accounts are a threat model concern. EPSS data was not provided; in the absence of KEV or POC signals, real-world exploitation risk is currently assessed as moderate but not imminent.

An attacker with a low-privilege local account - gained via phishing, credential theft, or RDP access - calls a Windows Biometric Service API or IPC endpoint with a specially crafted oversized buffer. The heap overflow corrupts adjacent heap metadata or function pointers within the wbiosrvc process, redirecting execution to attacker-controlled shellcode and yielding SYSTEM-level privileges. No public proof-of-concept has been identified, but the AC:L rating suggests the trigger is straightforward once the overflow offset is determined.