CVE-2026-72991: Windows Biometric Service Privilege Escalation

CVE-2026-72991 Overview

CVE-2026-72991 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

The vulnerability requires local access and low privileges but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability. The Windows Biometric Service handles biometric authentication data on Windows endpoints and typically runs with elevated privileges, making it an attractive target for local privilege escalation.

Critical Impact
A low-privileged local user can corrupt heap memory in the Windows Biometric Service to execute code at a higher privilege level, resulting in full system compromise.

Affected Products

Microsoft Windows (versions listed in the Microsoft Security Update Guide for CVE-2026-72991)
Windows Biometric Service component
Refer to the Microsoft Security Update Guide for the full list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72991 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72991

Vulnerability Analysis

The flaw is a heap-based buffer overflow inside the Windows Biometric Service. Heap overflows overwrite memory adjacent to an allocated buffer on the process heap. When the overwritten region contains function pointers, object headers, or heap metadata, an attacker can influence control flow.

The Windows Biometric Service brokers requests between user-mode applications and biometric sensor drivers. Because the service runs at a higher privilege level than a standard user, an attacker who corrupts its heap can pivot from a limited account to SYSTEM-level execution. The vulnerability requires the attacker to already hold valid credentials on the target machine.

Root Cause

The root cause is improper validation of the size of attacker-influenced input before it is copied into a heap buffer inside the Windows Biometric Service. This class of defect is tracked as [CWE-122] Heap-based Buffer Overflow. Microsoft has not published detailed root-cause analysis beyond the advisory in the Microsoft Security Update Guide.

Attack Vector

Exploitation requires local access to the target Windows host and a valid low-privileged account. The attacker interacts with the Windows Biometric Service through its exposed inter-process communication surface and submits crafted data that triggers the overflow. No user interaction is required. Remote exploitation over the network is not applicable to this vulnerability.

A verified proof-of-concept has not been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical exploitation details are described in prose because no verified public code examples are available. See the Microsoft Security Update Guide for vendor-provided technical context.

Detection Methods for CVE-2026-72991

Indicators of Compromise

Unexpected crashes or restarts of the Windows Biometric Service (WbioSrvc) recorded in the System event log
New processes spawned as SYSTEM whose parent chain traces back to svchost.exe hosting WbioSrvc
Werfault or WER crash dumps referencing the biometric service binary immediately followed by privileged process creation

Detection Strategies

Correlate biometric service crashes with subsequent privilege-escalation behavior on the same host within a short time window
Baseline expected callers of the Windows Biometric Service and flag unusual client processes issuing biometric API requests
Monitor for creation of scheduled tasks, services, or persistence artifacts that appear shortly after biometric service anomalies

Monitoring Recommendations

Enable process creation logging (Event ID 4688) with command-line auditing and forward to a central analytics platform
Collect Windows Error Reporting and Application/System event logs from all endpoints that expose biometric authentication
Alert on service-hosted svchost.exe instances spawning interactive shells such as cmd.exe or powershell.exe

How to Mitigate CVE-2026-72991

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-72991 as soon as testing permits
Prioritize patching on multi-user systems, jump hosts, and workstations where users log in interactively
Audit local account inventories and remove unused or stale accounts that could be leveraged for local exploitation

Patch Information

Microsoft has released a security update for this vulnerability. Consult the Microsoft Security Update Guide entry for CVE-2026-72991 to identify the specific KB article and build numbers applicable to each Windows release in your environment. Deploy through Windows Update, WSUS, Microsoft Intune, or Configuration Manager based on your existing patch workflow.

Workarounds

Where biometric authentication is not required, disable the Windows Biometric Service (WbioSrvc) to remove the attack surface
Restrict interactive and remote-interactive logon rights to the minimum set of users required for the host
Enforce application allow-listing to reduce the ability of low-privileged users to run arbitrary local tooling

bash

# Configuration example: disable the Windows Biometric Service on hosts that do not use biometrics
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc