CVE-2026-72990: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-72990 Overview

CVE-2026-72990 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows and Windows Server systems. Successful exploitation yields high impact to confidentiality, integrity, and availability under a local attack vector with low complexity and low privileges required.

Microsoft published an advisory tracking this issue on the Microsoft Security Response Center portal. The vulnerability affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2016 through 2025.

Critical Impact
A local attacker with standard user privileges can corrupt heap memory in the Windows Biometric Service and gain SYSTEM-level code execution.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-72990 published to the National Vulnerability Database
2026-09-10 - Last updated in the NVD database

Technical Details for CVE-2026-72990

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) manages biometric enrollment, capture, and authentication data on behalf of the Windows Biometric Framework. The service runs as a SYSTEM-privileged host process and exposes RPC interfaces that local user-mode clients invoke to submit biometric samples and metadata.

CVE-2026-72990 stems from an improperly bounded write to a heap buffer allocated inside this service. When a local caller supplies a crafted request, the service writes past the end of the destination allocation. The overflow corrupts adjacent heap metadata or object pointers, enabling an attacker to hijack control flow inside a SYSTEM process.

The issue is classified as a heap-based buffer overflow under [CWE-122]. Exploitation requires local access and standard user privileges, but no user interaction, which makes it viable as a second-stage tool after any initial foothold on the host.

Root Cause

The root cause is missing or inadequate length validation on attacker-controlled input passed to the biometric service before it is copied into a heap allocation. When the input size exceeds the allocated buffer, the copy operation overruns the destination, overwriting adjacent heap structures used by the service.

Attack Vector

An attacker must first obtain code execution as a low-privileged local user. From that context, the attacker calls the vulnerable Biometric Service interface with a specially crafted payload sized to overflow the target heap chunk. Because the service runs as SYSTEM, successful exploitation escalates privileges from a standard user to the highest local privilege level on the machine.

No verified public proof-of-concept code is available for this issue at the time of publication. Refer to the Microsoft advisory for CVE-2026-72990 for authoritative technical details.

Detection Methods for CVE-2026-72990

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the WbioSrvc service or the hosting svchost.exe instance
New SYSTEM-owned processes spawned as children of the Windows Biometric Service outside normal biometric enrollment workflows
Unusual local RPC traffic to the Windows Biometric Framework interfaces from non-standard client binaries

Detection Strategies

Hunt for standard user accounts that transition to SYSTEM without an expected mechanism such as scheduled tasks, installers, or service control operations
Alert on abnormal loading of biometric client libraries such as winbio.dll by processes that do not normally interact with biometric hardware
Correlate Biometric Service crashes with subsequent creation of persistence artifacts (services, scheduled tasks, or registry Run keys) on the same host

Monitoring Recommendations

Enable and forward Windows Security, System, and Application event logs to a centralized analytics platform for privilege escalation hunting
Monitor Sysmon Event ID 1 (process creation) and Event ID 10 (process access) for anomalous access to WbioSrvc
Track patch compliance for the September 2026 Microsoft security updates across all Windows and Windows Server assets

How to Mitigate CVE-2026-72990

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72990 to every affected Windows and Windows Server system
Prioritize patching on multi-user hosts such as Remote Desktop Session Hosts, VDI infrastructure, and shared developer workstations where local footholds are more likely
Restrict interactive and remote logon rights on servers to reduce the population of accounts able to reach the local attack surface

Patch Information

Microsoft addressed CVE-2026-72990 through the security update published on the MSRC vulnerability page. Administrators should consult the advisory for the specific KB article and build numbers that apply to each affected Windows 10, Windows 11, and Windows Server release, then validate deployment through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

Disable the Windows Biometric Service (WbioSrvc) on systems that do not require Windows Hello or other biometric authentication, after validating operational impact
Remove or unbind biometric hardware where biometric authentication is not part of the sign-in policy for the endpoint
Enforce application allowlisting to block untrusted binaries from executing and reaching the local Biometric Service RPC interface

bash

# Configuration example: disable the Windows Biometric Service where biometrics are not required
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc