Windows Biometric Service EUVD-2026-99540

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low-level privileges (PR:L) and the ability to interact with the Windows Biometric Service (WbioSrvc) - a component present by default on affected Windows 10, Windows 11, and Windows Server builds. There is no remote network vector (AV:L) and no user interaction by a victim is needed (UI:N). Exploitation is limited by the need for an existing local foothold, the authenticated privilege requirement, and the fact that impact is confined to information disclosure (C:H) with no integrity or availability effect, meaning the bug alone cannot grant code execution or system takeover without further chaining.

This is a genuinely moderate-severity, low-urgency issue - not a top patching priority despite the CRITICAL-sounding 'heap-based buffer overflow' label. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) tells a consistent story: the attacker must already have local access and at least low-level privileges (PR:L), there is no integrity or availability impact, and the only consequence is confidentiality disclosure (C:H) - this is an information-disclosure bug, not remote code execution, even though CWE-122 heap overflows are often associated with RCE. All exploitation signals point the same direction with no conflict: CISA's SSVC decision framework scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which aligns with the absence of any KEV listing and no public proof-of-concept. EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one point worth verifying is that a heap buffer overflow is classified purely as information disclosure (C:H/I:N/A:N) - memory-corruption primitives can sometimes be chained toward code execution, so treat the 'disclosure only' impact as the vendor's current assessment rather than an immutable ceiling. Overall: a patch-in-normal-cycle local info-leak requiring existing authenticated footing.

An attacker who already has low-privileged authenticated access to a Windows host (for example a standard local user or a foothold from another compromise) interacts with the Windows Biometric Service to trigger a heap-based buffer overflow that leaks adjacent process memory. The disclosed memory could contain sensitive data such as biometric material or other secrets, aiding privilege escalation or lateral movement. No public exploit identified at time of analysis, and exploitation requires local presence rather than remote network access.