CVE-2026-73002: Windows Biometric Service Privilege Escalation

CVE-2026-73002 Overview

CVE-2026-73002 is an integer overflow vulnerability [CWE-190] in the Windows Biometric Service. An authorized local attacker can trigger the flaw to elevate privileges on an affected system. Microsoft published the advisory on September 8, 2026.

Successful exploitation grants full impact to confidentiality, integrity, and availability of the target host. The attacker must already hold low-privileged local access before invoking the vulnerable code path. No user interaction is required to complete the escalation.

Critical Impact
Local attackers with valid low-privilege credentials can escalate to elevated privileges on affected Windows systems by exploiting an arithmetic wraparound in the Biometric Service.

Affected Products

Microsoft Windows (Windows Biometric Service component)
Refer to the Microsoft Security Update Guide for the full list of affected builds
Systems running Windows Hello or fingerprint-based biometric authentication

Discovery Timeline

2026-09-08 - CVE-2026-73002 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-73002

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) brokers biometric enrollment, matching, and authentication requests between client applications and biometric sensor drivers. The service runs with elevated privileges to mediate access to protected biometric templates and sensor hardware.

CVE-2026-73002 stems from an integer overflow or wraparound condition inside this service. When the service processes a specially crafted request, an arithmetic operation exceeds the maximum value of its integer type and wraps to a smaller value. Downstream code then uses the truncated value in a size or index calculation, producing an unsafe memory operation.

Because the Biometric Service executes with higher privileges than the calling process, an authorized local attacker can leverage the corrupted state to run code or manipulate objects in the service's security context. This yields a local privilege escalation from a low-integrity account to a higher-integrity one.

Root Cause

The root cause is an unchecked arithmetic operation on attacker-influenced input inside the Biometric Service. Missing bounds validation before the arithmetic allows the result to wrap around. The service then trusts the wrapped value in subsequent memory allocation or copy logic.

Attack Vector

Exploitation requires local access and a valid low-privileged account on the target host. The attacker sends crafted input to the Biometric Service through its client interface. No user interaction is required, and the attack complexity is low.

The vulnerability mechanism is described in prose because no verified public proof-of-concept is available. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-73002

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc service reported in the System event log
New or unusual child processes spawned by svchost.exe hosting the Biometric Service
Anomalous access to biometric database files under %WINDIR%\System32\WinBioDatabase\
Local accounts gaining elevated access without a corresponding administrative logon event

Detection Strategies

Monitor for repeated failures or abnormal restarts of the Windows Biometric Service, which may indicate exploitation attempts
Alert on process creations by the Biometric Service host that deviate from a documented baseline
Correlate biometric API call bursts from low-privileged processes with subsequent privilege changes
Apply behavior-based endpoint detection rules that flag privilege escalation chains originating from service-hosted processes

Monitoring Recommendations

Enable Windows Event Log forwarding for Security, System, and Application channels to a central SIEM
Ingest Sysmon Event ID 1 (process creation) and Event ID 10 (process access) targeting svchost.exe -k WbioSrvc
Track service configuration changes to the Biometric Service via Event ID 7040
Baseline biometric authentication activity and alert on statistical deviations

How to Mitigate CVE-2026-73002

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as the patch is validated in your environment
Prioritize patching on multi-user systems, shared workstations, and any host where low-privileged users can execute code
Audit local account membership and remove unnecessary interactive logon rights
Verify endpoint protection agents are current and reporting to central management

Patch Information

Microsoft addressed CVE-2026-73002 in the security updates listed in the Microsoft Security Update Guide. Administrators should consult the guide for the specific Knowledge Base (KB) article and build numbers that apply to each supported Windows version. Deploy updates through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune according to standard change control.

Workarounds

Disable the Windows Biometric Service (WbioSrvc) on hosts that do not require Windows Hello or fingerprint authentication
Restrict interactive and remote desktop access to trusted administrators until patches are deployed
Enforce application allowlisting to block untrusted binaries from invoking biometric APIs
Remove biometric enrollment on shared or kiosk systems where the feature is not operationally required

bash

# Temporarily disable the Windows Biometric Service where biometrics are not required
sc.exe stop WbioSrvc
sc.exe config WbioSrvc start= disabled

# Verify current service state
sc.exe query WbioSrvc