CVE-2026-70573: Windows Biometric Service Privilege Escalation

CVE-2026-70573 Overview

CVE-2026-70573 is a heap-based buffer overflow vulnerability in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows systems. The root cause is classified under [CWE-20] Improper Input Validation, which triggers a heap corruption condition during biometric data processing. Successful exploitation grants the attacker higher privileges than their current context, potentially enabling full compromise of the affected host. Microsoft published the advisory on September 8, 2026, through the Microsoft Security Response Center. The vulnerability requires local access and low-privileged authentication, but the attack complexity is high, limiting opportunistic exploitation.

Critical Impact
Local attackers with valid credentials can trigger heap corruption in the Windows Biometric Service to gain elevated privileges, compromising confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows (versions listed in the Microsoft Security Update Guide)
Windows Biometric Service (WbioSrvc)
Systems with biometric authentication enabled (Windows Hello and related components)

Discovery Timeline

2026-09-08 - CVE-2026-70573 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-70573

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) manages biometric enrollment, authentication, and template storage for Windows Hello and third-party biometric providers. The service runs with elevated privileges and processes structured biometric input from user-mode callers. CVE-2026-70573 stems from improper input validation on data supplied to the service, which leads to a heap-based buffer overflow.

An attacker who is already authenticated on the target system can craft malformed biometric requests that overflow a heap buffer inside the service process. Because the service handles the data at a higher privilege level than the caller, corrupting service memory can lead to controlled code execution or object manipulation. The high attack complexity reflects the need for precise heap layout control and timing to achieve reliable privilege escalation.

Root Cause

The defect is classified as [CWE-20] Improper Input Validation. The service fails to correctly validate the size or structure of input before copying it into a heap-allocated buffer. This missing bounds check allows adjacent heap metadata or object pointers to be overwritten, giving the attacker a primitive to hijack execution flow inside a privileged process.

Attack Vector

Exploitation requires local access and a valid low-privileged account. The attacker interacts with the biometric service through its exposed interfaces, submits malformed input, and manipulates the heap to convert the overflow into code execution or token theft. Remote exploitation is not possible without prior authentication and local presence on the host. See the Microsoft Security Update Guide for technical details specific to affected builds.

Detection Methods for CVE-2026-70573

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc service recorded in the Windows Service Control Manager event log.
Application error events referencing wbiosrvc.dll or the Windows Biometric Service host process with heap corruption exception codes such as 0xC0000374.
Creation of new privileged processes as immediate children of the biometric service host.

Detection Strategies

Monitor for anomalous child processes spawned by svchost.exe instances hosting the Windows Biometric Service.
Alert on repeated access to biometric service RPC interfaces from non-standard user contexts.
Correlate biometric service crashes with subsequent privilege changes, new local administrators, or token manipulation events.

Monitoring Recommendations

Enable Windows Event Log forwarding for Application, System, and Security channels to a centralized SIEM.
Track Sysmon Event ID 1 (process creation) and Event ID 11 (file creation) for biometric service directories.
Baseline normal biometric authentication activity so deviations in call frequency or caller identity trigger investigation.

How to Mitigate CVE-2026-70573

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all affected Windows systems.
Prioritize patching hosts where biometric authentication is enabled and where multiple interactive users have local access.
Audit local account membership and remove unnecessary standard user access from sensitive endpoints.

Patch Information

Microsoft addressed CVE-2026-70573 in the September 2026 security update cycle. Administrators should consult the Microsoft Security Update Guide for the specific KB article and build numbers that apply to each Windows version in their environment. Deploy through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft Configuration Manager.

Workarounds

Disable the Windows Biometric Service (WbioSrvc) on systems that do not require Windows Hello or third-party biometric authentication.
Restrict interactive logon rights on high-value endpoints to reduce the population of accounts that can reach the vulnerable service.
Enforce application control policies to limit which binaries can invoke biometric service RPC interfaces.

bash

# Disable the Windows Biometric Service on hosts that do not require it
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc