CVE-2026-72995 Overview
CVE-2026-72995 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service that enables local privilege escalation. An authenticated attacker with low privileges can corrupt heap memory in the service to gain higher privileges on the affected host. Microsoft published the advisory on 2026-09-08 covering Windows 10, Windows 11, and Windows Server editions from Server 2016 through Server 2025.
Critical Impact
Successful exploitation grants an attacker elevated privileges on the local system, providing full confidentiality, integrity, and availability impact against the compromised host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-09-08 - CVE-2026-72995 published to NVD
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-72995
Vulnerability Analysis
The Windows Biometric Service (WbioSrvc) manages biometric enrollment, authentication, and sensor communication for features such as Windows Hello. The service runs with elevated privileges and exposes RPC interfaces reachable from lower-privileged callers on the local system. A heap-based buffer overflow in this component allows an authenticated local attacker to write beyond the bounds of an allocated heap buffer.
Controlled heap corruption in a privileged service is a common precursor to privilege escalation. An attacker can shape the heap to overwrite adjacent objects, function pointers, or metadata used by the service. Successful exploitation transitions the attacker from a standard user context to code execution in the biometric service, breaking the local security boundary.
Root Cause
The root cause is improper validation of the size or contents of attacker-controlled input before it is copied into a heap allocation inside the biometric service. This class of flaw is tracked as [CWE-122: Heap-based Buffer Overflow]. Microsoft has not published detailed technical internals beyond the security update guidance.
Attack Vector
Exploitation requires local access and a valid low-privileged account on the target machine. No user interaction is required. The attacker sends crafted requests to the Windows Biometric Service to trigger the overflow and manipulate heap state, ultimately hijacking control flow within the privileged service process. See the Microsoft Security Update Guide for CVE-2026-72995 for authoritative details.
No public proof-of-concept or exploit code has been observed at the time of publication.
Detection Methods for CVE-2026-72995
Indicators of Compromise
- Unexpected crashes, restarts, or Windows Error Reporting (WER) entries for the WbioSrvc service or svchost.exe host process running the biometric service.
- Creation of child processes by the biometric service host that are not part of normal biometric operations.
- New or unexpected privileged token use following biometric service activity by a low-privileged account.
Detection Strategies
- Hunt for process lineage anomalies where svchost.exe hosting WbioSrvc spawns command interpreters, script hosts, or LOLBins.
- Correlate local logons from standard users with subsequent SYSTEM-level process creation events within a short time window.
- Alert on repeated exceptions or access violations attributed to the Windows Biometric Service in the Application and System event logs.
Monitoring Recommendations
- Ingest Sysmon Event IDs 1 (process creation), 10 (process access), and 11 (file create) for the biometric service host into your SIEM.
- Track Windows Event Log sources Microsoft-Windows-Biometrics and Application Error for anomalous entries.
- Monitor patch compliance for the Windows Biometric Service across all in-scope Windows 10, 11, and Server builds.
How to Mitigate CVE-2026-72995
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72995 to all affected Windows and Windows Server systems.
- Prioritize workstations that use Windows Hello or other biometric authentication, and multi-user systems such as RDS hosts and VDI images.
- Audit local account privileges and remove unnecessary interactive logon rights to reduce the pool of potential local attackers.
Patch Information
Microsoft has released fixes through the standard Windows security update channels. Refer to the Microsoft Security Update Guide for CVE-2026-72995 for the specific KB article and build numbers for each affected Windows 10, Windows 11, and Windows Server release.
Workarounds
- Where biometric authentication is not required, disable the Windows Biometric Service by setting WbioSrvc startup type to Disabled and stopping the service.
- Restrict local logon rights and enforce least privilege so that only trusted users can interact with the affected service.
- Enable exploit protection and attack surface reduction rules to raise the cost of local privilege escalation attempts pending patch deployment.
# Disable the Windows Biometric Service where biometrics are not used
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc
# Verify patch installation (replace KB number with the KB from the MSRC advisory)
wmic qfe list brief | findstr /I "KBxxxxxxx"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
