CVE-2026-73000: Windows Biometric Service Escalation Flaw

CVE-2026-73000 Overview

CVE-2026-73000 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. Microsoft disclosed the issue through the Microsoft Security Response Center (MSRC) update guide.

The vulnerability requires local access and low privileges, with no user interaction. Successful exploitation impacts confidentiality, integrity, and availability. The Exploit Prediction Scoring System (EPSS) score is 0.245% with a percentile of 15.75, indicating low near-term exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A local attacker with standard user privileges can corrupt heap memory in the Windows Biometric Service to gain SYSTEM-level privileges.

Affected Products

Microsoft Windows (Windows Biometric Service component)
Refer to the Microsoft Security Update CVE-2026-73000 advisory for the full list of affected Windows builds

Discovery Timeline

2026-09-08 - CVE-2026-73000 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73000

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) manages biometric enrollment, capture, and identification for authentication providers such as Windows Hello. The service runs under a privileged security context and accepts requests from user-mode clients through Remote Procedure Call (RPC) interfaces.

CVE-2026-73000 is a heap-based buffer overflow within this service. An authorized local user can craft input that causes the service to write beyond the bounds of an allocated heap buffer. This corrupts adjacent heap metadata or object pointers, enabling arbitrary code execution in the service context.

Because the service handles data supplied by lower-privileged callers, an attacker holding a standard user account can transition to SYSTEM. This crosses a defined security boundary and bypasses standard Windows access controls.

Root Cause

The root cause is inadequate validation of the size or structure of attacker-controlled data before it is copied into a fixed-size heap allocation. Heap-based overflows [CWE-122] typically stem from missing length checks, integer miscalculations during allocation sizing, or trust in client-supplied length fields.

Attack Vector

Exploitation requires local access and a valid user session. The attacker interacts with the Biometric Service RPC interface, submits malformed biometric or configuration data, and triggers the overflow. No user interaction is required beyond the attacker's own actions.

Exploitation code is not publicly available. Technical details are limited; see the Microsoft Security Update CVE-2026-73000 advisory for vendor guidance.

Detection Methods for CVE-2026-73000

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc service recorded in the System event log or Windows Error Reporting
Creation of child processes by svchost.exe hosting the Windows Biometric Service that do not match the service's normal behavior
New SYSTEM-level processes spawned shortly after biometric API activity from a standard user session

Detection Strategies

Monitor process lineage for anomalous children of svchost.exe instances hosting WbioSrvc
Alert on repeated access failures or malformed RPC calls to the Biometric Service interface
Correlate local privilege transitions with prior biometric API usage by non-administrative users

Monitoring Recommendations

Enable Windows Error Reporting collection and forward crash telemetry to a central log store for review
Ingest Sysmon Event IDs 1 (process create) and 10 (process access) into a SIEM to baseline Biometric Service behavior
Track patch compliance on endpoints where Windows Hello and biometric authentication are enabled

How to Mitigate CVE-2026-73000

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-73000 to all affected Windows systems
Prioritize patching on multi-user systems, virtual desktop infrastructure, and shared workstations where local users are present
Audit local user accounts and remove unnecessary interactive logon rights

Patch Information

Microsoft has published a security update through the Microsoft Update Guide. Administrators should deploy the update via Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Microsoft Configuration Manager. Refer to the Microsoft Security Update CVE-2026-73000 page for the specific KB article and build numbers.

Workarounds

Disable the Windows Biometric Service (WbioSrvc) on systems that do not require Windows Hello or biometric authentication, if operationally acceptable
Restrict local logon on servers and administrative endpoints to reduce the pool of accounts able to reach the vulnerable interface
Enforce application allowlisting to limit execution of untrusted binaries by standard users

bash

# Configuration example: disable the Windows Biometric Service where not required
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc