CVE-2026-70572 Overview
CVE-2026-70572 is an integer overflow vulnerability [CWE-190] in the Windows Biometric Service. An authorized local attacker can trigger the flaw to elevate privileges on the affected system. Microsoft documented the issue in its Security Update Guide and assigned it a CVSS 3.1 base score of 7.8.
Successful exploitation grants the attacker high impact on confidentiality, integrity, and availability. The attack requires local access and low privileges, and no user interaction is needed. The Windows Biometric Service handles biometric data capture and authentication workflows, making it a sensitive component for privilege boundary enforcement.
Critical Impact
A local authenticated attacker can escalate to higher privileges through arithmetic wraparound in the Windows Biometric Service, gaining full control over the affected host.
Affected Products
- Microsoft Windows (Biometric Service component)
- Refer to the Microsoft Security Update Guide for the complete list of affected builds
- Systems with the Windows Biometric Service enabled
Discovery Timeline
- 2026-09-08 - CVE-2026-70572 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-70572
Vulnerability Analysis
The vulnerability resides in the Windows Biometric Service, which manages fingerprint, facial recognition, and other biometric authentication data. An integer overflow occurs when arithmetic operations on a size, index, or length value exceed the maximum representable value for the integer type. The result wraps around to an unexpected small value.
When the wrapped value is used in downstream memory allocation or bounds checks, it can produce undersized buffers or bypass validation logic. This condition allows subsequent memory operations to write beyond intended boundaries within the service process. Because the Windows Biometric Service runs with elevated privileges, memory corruption inside it can be leveraged to execute attacker-controlled logic in a higher privilege context.
Root Cause
The root cause is classified as [CWE-190] Integer Overflow or Wraparound. The service does not validate arithmetic results before using them in size-sensitive operations. Microsoft has not publicly disclosed the specific function or code path involved.
Attack Vector
The attack vector is local. An attacker must already have code execution on the target system with low-privileged credentials. From this foothold, the attacker interacts with the Biometric Service through its exposed interfaces to trigger the overflow. No user interaction is required, and the scope remains unchanged, meaning the impact is contained to the same security authority.
No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update Guide for authoritative technical detail.
Detection Methods for CVE-2026-70572
Indicators of Compromise
- Unexpected crashes or restarts of the Windows Biometric Service (WbioSrvc) recorded in the System event log
- Creation of new local accounts or privileged group membership changes shortly after biometric service anomalies
- Unusual child processes spawned by svchost.exe instances hosting the Biometric Service
Detection Strategies
- Monitor for anomalous process behavior originating from services running under NT AUTHORITY\SYSTEM following biometric API activity
- Correlate Windows Error Reporting (WER) entries for the Biometric Service with subsequent privilege changes
- Baseline normal Biometric Service memory and handle usage, and alert on statistical deviations
Monitoring Recommendations
- Enable Sysmon Event ID 1 (process create) and Event ID 10 (process access) for services hosting WbioSrvc
- Ingest Windows security, system, and application logs into a centralized analytics platform for correlation
- Track successful patch deployment across all Windows endpoints using configuration management telemetry
How to Mitigate CVE-2026-70572
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits
- Prioritize patching on multi-user systems, shared workstations, and hosts accessible to low-privileged users
- Audit local account inventories and remove unnecessary interactive logon rights
Patch Information
Microsoft has published the fix through its standard Security Update Guide. Administrators should consult the advisory to identify the specific KB article and cumulative update matching each Windows version in the environment. Deploy via Windows Update, WSUS, Microsoft Intune, or Configuration Manager.
Workarounds
- Where biometric authentication is not required, disable the Windows Biometric Service (WbioSrvc) and set its startup type to Disabled
- Restrict local logon rights and enforce least privilege to reduce the pool of accounts able to trigger the flaw
- Apply application control policies to limit which processes may interact with biometric service interfaces
# Disable the Windows Biometric Service where biometrics are not in use
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
