CVE-2026-72993: Windows Biometric Service Privilege Escalation

CVE-2026-72993 Overview

CVE-2026-72993 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. Successful exploitation yields high impact to confidentiality, integrity, and availability of the target host.

The vulnerability requires local access and low-privilege authentication, with no user interaction needed. Microsoft published details in the Microsoft CVE-2026-72993 Advisory.

Critical Impact
Authorized local attackers can corrupt heap memory in the Windows Biometric Service to execute code in an elevated context, enabling full system compromise from a standard user account.

Affected Products

Windows Biometric Service (Microsoft Windows)

Discovery Timeline

2026-09-08 - CVE-2026-72993 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72993

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) manages biometric enrollment, capture, and identification for Windows authentication. The service runs with elevated privileges and processes data submitted by lower-privileged clients through inter-process communication.

CVE-2026-72993 is a heap-based buffer overflow triggered when the service processes attacker-controlled input. Insufficient bounds validation on a heap-allocated buffer allows an authorized local attacker to write beyond the allocation boundary. The overflow corrupts adjacent heap structures used by the service.

Exploitation yields code execution in the security context of the biometric service, which typically runs with SYSTEM-adjacent privileges. Impact metrics are high across confidentiality, integrity, and availability.

Root Cause

The root cause is a missing or incorrect length check on data written to a heap buffer within the Windows Biometric Service. The service accepts input from clients but fails to verify that the input size fits the destination allocation. This class of defect is tracked as [CWE-122] Heap-based Buffer Overflow.

Attack Vector

The attack vector is local. An attacker must already hold valid credentials on the target system and be able to interact with the Windows Biometric Service. From that position, the attacker crafts a request that causes the service to overflow a heap buffer, then leverages the corruption for privilege escalation. No user interaction is required.

No public proof-of-concept exploit is listed for this CVE at the time of publication, and the Exploit Prediction Scoring System (EPSS) probability is low. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

See the Microsoft CVE-2026-72993 Advisory for vendor technical details.

Detection Methods for CVE-2026-72993

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting (WER) entries for the WbioSrvc service or its host process svchost.exe.
Child processes spawned by the Windows Biometric Service that deviate from the normal baseline, particularly cmd.exe, powershell.exe, or other LOLBins.
New privileged accounts, services, or scheduled tasks created shortly after biometric service anomalies on the same host.

Detection Strategies

Monitor process ancestry for svchost.exe instances hosting WbioSrvc spawning unexpected child processes or loading unsigned modules.
Alert on repeated crashes of the Windows Biometric Service in the System event log, which can indicate exploitation attempts or fuzzing.
Correlate biometric service anomalies with subsequent local privilege escalation behaviors such as token manipulation or SYSTEM-context command execution.

Monitoring Recommendations

Collect Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) for biometric service host processes.
Ingest Windows Application and System event logs into a centralized SIEM to detect service crash patterns.
Baseline normal Windows Biometric Service behavior on endpoints with fingerprint or facial recognition hardware to reduce false positives.

How to Mitigate CVE-2026-72993

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72993 Advisory to all affected Windows systems.
Prioritize patching on multi-user systems, shared workstations, and hosts where non-administrative users have interactive logon rights.
Audit local account privileges and remove unnecessary interactive logon capabilities to reduce the pool of potential attackers.

Patch Information

Microsoft has issued a security update addressing CVE-2026-72993. Consult the Microsoft CVE-2026-72993 Advisory for the exact KB article, affected Windows versions, and package identifiers. Deploy the update through Windows Update, Microsoft Update Catalog, WSUS, or your existing patch management tooling.

Workarounds

If patching cannot be performed immediately, consider disabling the Windows Biometric Service (WbioSrvc) on hosts that do not require biometric authentication.
Restrict local logon rights on affected systems to limit which users can reach the vulnerable service.
Enforce application allowlisting and least-privilege policies to constrain post-exploitation activity from a compromised low-privilege account.

bash

# Temporarily stop and disable the Windows Biometric Service on systems that do not use biometrics
sc.exe stop WbioSrvc
sc.exe config WbioSrvc start= disabled