CVE-2026-83973: Windows Biometric Service Privilege Escalation

CVE-2026-83973 Overview

CVE-2026-83973 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can trigger the overflow to elevate privileges on an affected host. Microsoft published the advisory on 2026-09-08 with a CVSS 3.1 base score of 7.8.

The flaw requires low privileges and no user interaction. Successful exploitation results in high impact to confidentiality, integrity, and availability. The Windows Biometric Service (WbioSrvc) manages fingerprint and facial recognition data for Windows Hello and related sign-in features, making it a valuable pivot for local privilege escalation.

Critical Impact
A local, authenticated attacker can corrupt heap memory in the Windows Biometric Service to execute code at elevated privilege and take full control of the host.

Affected Products

Microsoft Windows (Windows Biometric Service component)
See the Microsoft Security Update Guide for the full list of affected Windows builds
Systems with the Windows Biometric Framework enabled (Windows Hello deployments)

Discovery Timeline

2026-09-08 - CVE-2026-83973 published to NVD
2026-09-08 - Microsoft releases security update for CVE-2026-83973
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-83973

Vulnerability Analysis

The vulnerability resides in the Windows Biometric Service, a system service that brokers requests between client applications and biometric hardware providers. The service handles serialized biometric payloads, IOCTL requests, and RPC calls from user-mode callers. A heap-based buffer overflow occurs when the service processes attacker-controlled input without properly validating a size or length field before copying data into a heap allocation.

Because the service runs with elevated privileges, corrupting its heap can be leveraged to overwrite adjacent allocations, function pointers, or object vtables. An attacker with a valid local account can craft a request that produces controlled memory corruption and pivots into arbitrary code execution in the service context.

Root Cause

The root cause is classified under [CWE-122] Heap-Based Buffer Overflow. A code path in the biometric service performs a copy operation using a length derived from untrusted input, without bounding it against the destination heap buffer size. The resulting out-of-bounds write on the heap creates the primitive required for privilege escalation.

Attack Vector

The attack vector is local. An authenticated user on the target system sends a malformed request to the Windows Biometric Service through its exposed IPC surface, such as the RPC or ALPC interfaces used by biometric clients. No user interaction is required beyond the attacker's own session. Exploitation does not require administrative rights, only the ability to communicate with the service as a standard user.

No public proof-of-concept is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.318%.

Detection Methods for CVE-2026-83973

Indicators of Compromise

Unexpected crashes or restarts of the WbioSrvc service or the svchost.exe process hosting it, particularly with heap corruption exception codes such as 0xC0000374.
Windows Error Reporting entries referencing wbiosrvc.dll, winbio.dll, or winbiokernel fault modules.
New or unusual child processes spawned by the Windows Biometric Service process.

Detection Strategies

Monitor process creation events (Windows Event ID 4688 or Sysmon Event ID 1) where the parent is the biometric service host and the child is a shell, script interpreter, or LOLBin.
Alert on standard users opening handles to biometric RPC endpoints outside of expected Windows Hello workflows.
Correlate service crash events (Event ID 7031/7034) for WbioSrvc with subsequent privilege changes on the same host.

Monitoring Recommendations

Enable command-line and module-load auditing on endpoints with Windows Hello enabled and forward events to a centralized log platform.
Track patch deployment status for the September 2026 Microsoft security updates across the estate.
Baseline normal biometric service activity so that anomalous IPC volume or crash frequency triggers investigation.

How to Mitigate CVE-2026-83973

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide entry for CVE-2026-83973 to all affected Windows systems.
Prioritize patching multi-user systems, shared workstations, virtual desktop infrastructure, and hosts where standard users can log in interactively.
Audit local account usage and remove unnecessary interactive logon rights to reduce the population of accounts that can reach the vulnerable service.

Patch Information

Microsoft addressed CVE-2026-83973 in the security update released on 2026-09-08. Refer to the Microsoft Security Update Guide for the specific KB articles and cumulative updates that apply to each supported Windows version.

Workarounds

If patching is delayed, disable the Windows Biometric Service (WbioSrvc) on systems that do not require Windows Hello, biometric sign-in, or fingerprint authentication.
Remove or disable enrolled biometric providers through Group Policy where biometric authentication is not a business requirement.
Restrict local logon rights so that only trusted users can interact with the affected service surface.

bash

# Configuration example: disable the Windows Biometric Service where not required
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc

# Group Policy path to disable biometrics:
# Computer Configuration > Administrative Templates > Windows Components > Biometrics
#   > "Allow the use of biometrics" = Disabled