CVE-2026-72994: Windows Biometric Service Privilege Escalation

CVE-2026-72994 Overview

CVE-2026-72994 is a heap-based buffer overflow in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. Microsoft classifies the issue as an elevation of privilege vulnerability tied to improper input validation [CWE-20].

Successful exploitation grants high impact to confidentiality, integrity, and availability, allowing an attacker who already has low-privileged access to gain higher-privileged execution within the biometric service process context. Refer to the Microsoft Security Update Guide CVE-2026-72994 for the vendor advisory.

Critical Impact
A local, low-privileged attacker can trigger a heap corruption in the Windows Biometric Service to elevate privileges and compromise the host.

Affected Products

Windows Biometric Service (Microsoft Windows)
Refer to Microsoft's advisory for the full list of impacted Windows builds
No specific product versions were enumerated in the NVD entry at publication time

Discovery Timeline

2026-09-08 - CVE-2026-72994 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72994

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) brokers biometric enrollment, verification, and identification requests between client applications and biometric sensor drivers. The service runs with elevated privileges and exposes an RPC interface reachable from local, authenticated contexts.

CVE-2026-72994 is a heap-based buffer overflow triggered when the service processes attacker-controlled input without adequate size validation. Because the flaw is rooted in improper input validation [CWE-20], a crafted request can write past an allocated heap buffer inside the service process. Controlled heap corruption in a privileged service typically enables arbitrary code execution in that service's security context, resulting in local privilege escalation.

Exploitation requires an authenticated user on the target system. No user interaction is required, and the attack complexity is low, which makes this a useful post-compromise primitive for adversaries who already hold a foothold as a standard user.

Root Cause

The root cause is missing or insufficient bounds checking on data passed to a heap allocation used by the Windows Biometric Service. When the service copies attacker-supplied bytes into an undersized heap buffer, adjacent heap metadata or objects are overwritten, corrupting service state.

Attack Vector

The attack vector is local. An authenticated attacker sends a malformed request to the Windows Biometric Service RPC endpoint, or invokes a client API that reaches the vulnerable code path, causing the overflow. Successful exploitation elevates the attacker's privileges to those of the biometric service. See the Microsoft Security Update Guide CVE-2026-72994 for vendor guidance. No public proof-of-concept was available at the time of publication.

Detection Methods for CVE-2026-72994

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the WbioSrvc service or its host svchost.exe instance
Child processes spawned by the Windows Biometric Service host that do not match normal biometric workflows
Anomalous local RPC activity targeting the biometric service from low-privileged user sessions

Detection Strategies

Alert on new or unusual processes launched under the security context of the Windows Biometric Service
Monitor for token manipulation or privilege changes originating from standard user accounts shortly after biometric service activity
Correlate service crashes with subsequent execution of administrative tools such as cmd.exe, powershell.exe, or net.exe under elevated tokens

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on endpoints that expose biometric hardware
Forward service crash telemetry and Windows Error Reporting events to a central analytics platform for baseline deviation analysis
Track patch state of the Windows Biometric Service across the fleet to identify unpatched hosts at risk

How to Mitigate CVE-2026-72994

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-72994 as soon as testing permits
Prioritize patch deployment on multi-user systems, virtual desktop infrastructure, and hosts where untrusted users have interactive logon rights
Audit which endpoints actually require the Windows Biometric Service and disable it where biometric authentication is not used

Patch Information

Microsoft has published patch details in the Microsoft Security Update Guide CVE-2026-72994. Consult the advisory for the specific KB numbers and build revisions that address the vulnerability on each supported Windows release.

Workarounds

Stop and disable the Windows Biometric Service (WbioSrvc) on systems that do not use Windows Hello or other biometric authentication
Restrict interactive and Remote Desktop logon rights to trusted administrative users on high-value systems until patches are applied
Enforce least privilege on end-user accounts to limit the local attack surface available to a would-be attacker

bash

# Configuration example: disable the Windows Biometric Service where unused
sc.exe stop WbioSrvc
sc.exe config WbioSrvc start= disabled