Windows Biometric Service EUVD-2026-73803

Exploitation requires local authenticated access with at minimum a standard user account (PR:L per CVSS). The Windows Biometric Service must be running, which it is by default on Windows hosts configured with fingerprint readers or Windows Hello facial recognition hardware; it may be disabled in locked-down server environments that have never enabled biometric login. No network access, no user interaction, and no special runtime configuration beyond service availability are required. The primary constraint is that the attacker must already have code execution or an interactive session on the target machine under a low-privileged account - this is a privilege escalation, not an initial access vector.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a reliable, no-interaction local privilege escalation: any standard user account suffices (PR:L), no race condition or special configuration is required (AC:L), and full CIA compromise follows successful exploitation. EPSS data is absent, but the combination of a heap overflow in a default Windows service, low attack complexity, and broad platform coverage makes this a realistic post-compromise tool - useful in ransomware staging, lateral movement chains, or insider-threat scenarios. No public POC exists and the vulnerability is not listed in CISA KEV, so opportunistic mass exploitation is not observed; however, even a mid-sized municipal IT team in tczew should treat this as urgent patching given that any low-privileged foothold on an unpatched host immediately becomes a full system compromise. The absence of UI interaction means no phishing step is required beyond initial access.

An attacker who has gained initial access to a Windows endpoint as a standard domain user - via phishing, credential stuffing, or supply-chain compromise - sends a crafted request to the Windows Biometric Service IPC channel, triggering the heap overflow. Heap metadata corruption allows the attacker to redirect execution flow within the high-integrity service process, yielding a SYSTEM shell without any additional user interaction or elevated credentials.