CVE-2026-72992: Windows Biometric Service Privilege Escalation

CVE-2026-72992 Overview

CVE-2026-72992 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory on 2026-09-08 through the Microsoft Security Response Center. Successful exploitation grants the attacker high impact to confidentiality, integrity, and availability of the target system.

Critical Impact
Local privilege escalation via memory corruption in a core Windows service, enabling attackers with low-privileged access to gain elevated code execution on the host.

Affected Products

Microsoft Windows (Windows Biometric Service component)
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
No additional product enumeration is published in NVD at this time

Discovery Timeline

2026-09-08 - CVE-2026-72992 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72992

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) brokers biometric enrollment, identification, and verification requests between client applications and biometric device drivers. The service runs with elevated privileges to interact with sensor hardware and the credential store. A heap-based buffer overflow inside this service allows an authorized attacker to corrupt process memory. Because the service handles attacker-influenced data on a privileged heap, corruption can be steered toward control-flow hijack or arbitrary write primitives. The end result is elevation from a low-privileged user context to the privilege level of the biometric service.

Root Cause

The issue is classified as a heap-based buffer overflow [CWE-122]. Overflows of this class stem from writing beyond an allocated heap buffer, typically due to missing or incorrect length validation before a copy or serialization operation. Microsoft has not published component-level source detail, but the CWE mapping indicates unsafe memory handling within a request path exposed to authenticated local callers.

Attack Vector

Exploitation requires local access and low-privileged authentication (AV:L/PR:L). No user interaction is required. An attacker sends crafted input to the Windows Biometric Service through its exposed inter-process communication interface. The malformed request triggers the overflow inside the privileged service process, enabling privilege escalation to the service account. Refer to the Microsoft Security Update Guide for vendor-published exploitation prerequisites.

No public proof-of-concept exploit is currently listed for CVE-2026-72992, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog at time of publication.

Detection Methods for CVE-2026-72992

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc (Windows Biometric Service) process recorded in the Windows Application and System event logs
Windows Error Reporting (WER) entries referencing wbiosrvc.dll with heap corruption exception codes such as 0xC0000374
Creation of new privileged processes spawned by or immediately following anomalous biometric service activity

Detection Strategies

Monitor for child processes of svchost.exe hosting the biometric service that deviate from historical baselines
Alert on local privilege escalation patterns where a low-privileged user account is followed by SYSTEM-level process creation on the same host within a short window
Correlate service crash telemetry with subsequent token manipulation or credential access behavior mapped to MITRE ATT&CK techniques T1068 (Exploitation for Privilege Escalation) and T1055 (Process Injection)

Monitoring Recommendations

Ingest Windows Security, System, and Application event logs into a centralized analytics pipeline for correlation across hosts
Track patch compliance for Windows client and server builds against the fix identified in the Microsoft Security Update Guide
Baseline normal biometric service behavior on endpoints that use Windows Hello so anomalous activity stands out

How to Mitigate CVE-2026-72992

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-72992 across all affected Windows systems
Prioritize patching on shared or multi-user endpoints where multiple low-privileged users can authenticate locally
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of potential attackers

Patch Information

Microsoft has published a security update through the Microsoft Security Update Guide. Administrators should identify the applicable KB article for their Windows build and deploy it through Windows Update, WSUS, Microsoft Intune, or their standard patch management tooling. Verify installation by confirming the updated build number after reboot.

Workarounds

If patching cannot be performed immediately, disable the Windows Biometric Service (WbioSrvc) on hosts that do not require Windows Hello or fingerprint authentication
Restrict local logon rights via Group Policy so only trusted accounts can reach the vulnerable IPC surface
Enforce application allowlisting to reduce the likelihood of an attacker running exploit code from a low-privileged context

bash

# Disable the Windows Biometric Service on hosts that do not require it
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc