CVE-2026-73011: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-73011 Overview

CVE-2026-73011 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. The vulnerability affects a wide range of client and server versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server 2016 through 2025.

Successful exploitation grants the attacker high impact to confidentiality, integrity, and availability of the target system. Microsoft published the advisory on 2026-09-08 and issued fixes through the standard Security Update Guide.

Critical Impact
A locally authenticated attacker can trigger a heap overflow in the Windows Biometric Service to gain elevated privileges, enabling full compromise of the affected host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-73011 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-73011

Vulnerability Analysis

The flaw resides in the Windows Biometric Service (WbioSrvc), which brokers biometric operations such as fingerprint enrollment and authentication between user-mode clients and biometric hardware drivers. The service runs with elevated privileges and exposes RPC endpoints reachable by local, authenticated users.

A heap-based buffer overflow [CWE-122] occurs when the service processes attacker-controlled input without correctly bounding the destination buffer. Overflowing the heap allocation corrupts adjacent memory structures, enabling attackers to influence control flow or overwrite security-relevant data. Successful exploitation results in code execution in the service context, which typically holds SYSTEM privileges.

Root Cause

The root cause is improper validation of the size of data written to a heap-allocated buffer inside the Windows Biometric Service. When a request from a local client exceeds the expected bounds, the service copies more bytes than the target allocation can hold, corrupting heap metadata or neighboring objects.

Attack Vector

Exploitation requires local access and low-privileged authentication. No user interaction is needed. An attacker with a standard user account can invoke the vulnerable RPC interface exposed by the biometric service and submit crafted input to trigger the overflow. Because the service runs at higher integrity than the caller, the outcome is local privilege escalation to SYSTEM.

No public proof-of-concept code has been observed, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified public exploit is available for CVE-2026-73011.
// See the Microsoft Security Update Guide for technical details:
// https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73011

Detection Methods for CVE-2026-73011

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc service recorded in the System event log.
Windows Error Reporting (WER) crash dumps referencing wbiosrvc.dll with heap corruption exceptions such as STATUS_HEAP_CORRUPTION (0xC0000374).
New processes spawned by svchost.exe hosting the Biometric Service running with SYSTEM privileges shortly after suspicious user activity.

Detection Strategies

Monitor for anomalous RPC traffic to the Windows Biometric Service originating from non-interactive or unusual user contexts.
Alert on privilege escalation patterns where a standard user session is immediately followed by a SYSTEM-level child process linked to svchost.exe hosting WbioSrvc.
Correlate service crashes with subsequent unusual process creation or credential access events to identify exploitation attempts.

Monitoring Recommendations

Enable Windows event log forwarding for Service Control Manager events (Event IDs 7031, 7034) related to the Biometric Service.
Ingest Sysmon Event ID 1 (process creation) and Event ID 10 (process access) to track unusual interactions with wbiosrvc.dll.
Retain crash dumps generated by WER for retrospective analysis of exploitation attempts against the biometric stack.

How to Mitigate CVE-2026-73011

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-73011 to all affected Windows client and server systems.
Prioritize patching on multi-user systems, jump hosts, and Remote Desktop Session Hosts where local users can reach the biometric service.
Audit local accounts and remove unnecessary interactive logon rights to reduce the pool of potential attackers.

Patch Information

Microsoft has released updates addressing CVE-2026-73011 for all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Refer to the Microsoft Security Update Guide for CVE-2026-73011 for the KB article and package identifiers matching each affected build.

Workarounds

Disable the Windows Biometric Service (WbioSrvc) on systems that do not require biometric authentication, using sc.exe config WbioSrvc start= disabled followed by a reboot.
Restrict local logon rights on servers and shared workstations to trusted administrators until patches are deployed.
Enforce application allow-listing to prevent execution of unauthorized binaries that could deliver exploitation payloads.

bash

# Disable the Windows Biometric Service on hosts that do not need biometrics
sc.exe stop WbioSrvc
sc.exe config WbioSrvc start= disabled

# Verify the current state of the service
sc.exe query WbioSrvc