CVE-2026-72997: Windows Biometric Service Escalation

CVE-2026-72997 Overview

CVE-2026-72997 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit this flaw to elevate privileges on the affected host. Successful exploitation yields high impact to confidentiality, integrity, and availability. Microsoft published the advisory in its Security Update Guide and has released fixes through the standard update channel.

Critical Impact
A local attacker with low privileges can corrupt heap memory in the Windows Biometric Service and gain elevated code execution on the affected system.

Affected Products

Microsoft Windows (Windows Biometric Service component)
Refer to the Microsoft CVE-2026-72997 Update Guide for the full list of affected Windows builds
No third-party affected products enumerated in NVD at the time of publication

Discovery Timeline

2026-09-08 - CVE-2026-72997 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72997

Vulnerability Analysis

The vulnerability resides in the Windows Biometric Service, the system service that brokers biometric enrollment and verification requests between client applications and biometric hardware. A heap-based buffer overflow in this service allows a locally authenticated attacker to write past the bounds of a heap allocation. Because the service runs with elevated privileges, controlled heap corruption can be leveraged to execute code in that context. The result is a local privilege escalation that grants the attacker rights beyond those held by the initial user account.

Root Cause

The root cause is classified under [CWE-122] Heap-based Buffer Overflow. The service allocates a heap buffer and subsequently writes attacker-influenced data without correctly validating the destination length. This overflow can overwrite adjacent heap metadata or object pointers, giving an attacker a primitive to hijack control flow inside the biometric service process. Microsoft has not published the specific vulnerable function or code path.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker sends crafted input to the Windows Biometric Service through its exposed interfaces, triggering the heap overflow inside the service. The vulnerability is not remotely exploitable and does not cross a trust boundary that would allow initial access without a foothold on the host. There is no public proof-of-concept, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. See the Microsoft CVE-2026-72997 Update Guide for vendor technical details.

Detection Methods for CVE-2026-72997

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the Windows Biometric Service (WbioSrvc) hosted in svchost.exe
Child processes spawned by the biometric service host that are not part of normal Windows operations
New or modified files and scheduled tasks created shortly after biometric service anomalies
Local privilege escalation events from standard user accounts that align with biometric service activity

Detection Strategies

Monitor for abnormal process behavior of svchost.exe hosting WbioSrvc, including memory access violations and unexpected module loads
Alert on token elevation events (Windows Event ID 4672) originating from processes descended from the biometric service
Correlate application crash events (Event IDs 1000 and 1001) referencing biometric service binaries such as wbiosrvc.dll
Baseline normal biometric enrollment and verification activity to surface anomalous client interactions with the service

Monitoring Recommendations

Enable process creation auditing with command-line logging on endpoints where biometric hardware is used
Forward Windows Security, Application, and Sysmon logs to a centralized analytics platform for correlation
Track patch status of the Windows Biometric Service component across the fleet and prioritize systems that expose biometric login
Review local privilege escalation detections and map suspicious sequences to MITRE ATT&CK technique T1068

How to Mitigate CVE-2026-72997

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72997 Update Guide to all affected Windows systems
Prioritize patching on multi-user systems, shared workstations, and hosts that permit interactive logon by lower-privileged accounts
Restrict local logon rights to the smallest possible set of users to limit the population that can trigger the flaw
Audit endpoints with biometric hardware enabled and validate that they receive updates from Windows Update or WSUS

Patch Information

Microsoft has released a security update addressing CVE-2026-72997. Consult the Microsoft CVE-2026-72997 Update Guide for the specific KB articles and cumulative update packages that apply to each Windows version in your environment. Deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager based on your patch management workflow.

Workarounds

On systems that do not require biometric authentication, disable the Windows Biometric Service (WbioSrvc) until the patch is deployed
Remove or disable biometric enrollment for user accounts on affected hosts if operational requirements allow
Enforce standard user privileges and application control policies to reduce the risk of an attacker chaining local access into elevation
Ensure endpoint security tooling is active and monitoring service and process behavior on hosts with biometric login enabled

bash

# Configuration example: disable the Windows Biometric Service as a temporary workaround
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc