CVE-2026-83977: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-83977 Overview

CVE-2026-83977 is a heap-based buffer overflow [CWE-122] in the Windows Biometric Service. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server platforms. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) and rates the issue at a CVSS 3.1 base score of 7.8. The vulnerability affects a broad range of supported Windows 10, Windows 11, and Windows Server releases running the Biometric Service.

Critical Impact
Successful exploitation yields high impact to confidentiality, integrity, and availability, enabling an authenticated user to escalate to SYSTEM-level privileges on the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-83977 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-83977

Vulnerability Analysis

The Windows Biometric Service (WbioSrvc) manages biometric enrollment, matching, and authentication operations through the Windows Biometric Framework. The service runs with SYSTEM privileges and accepts requests from local user sessions through documented RPC and IOCTL interfaces. A heap-based buffer overflow in this attack surface allows an authenticated local user to corrupt heap memory managed by the service. Because the service processes attacker-influenced data with elevated privileges, corruption of adjacent heap structures can be steered toward controlled write primitives. The outcome is local privilege escalation from a standard user context to SYSTEM.

Root Cause

The defect is classified as CWE-122, a heap-based buffer overflow. This category typically results from missing or incorrect length validation when copying attacker-supplied data into a fixed-size heap allocation. In the Biometric Service context, the corruption occurs in a code path reachable by an authorized local caller. Microsoft has not released detailed root-cause internals for CVE-2026-83977 beyond the MSRC advisory.

Attack Vector

Exploitation requires local access and low-privileged authentication on the target host. No user interaction is required. The attacker interacts with the Biometric Service through its exposed local interfaces and submits crafted input that overflows a heap allocation inside the service process. The scope remains unchanged, and the impact is limited to the local system. There are no confirmed public proof-of-concept exploits at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS currently estimates the exploitation likelihood at 0.311%.

No verified proof-of-concept code is available. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-83977

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting (WER) entries for the WbioSrvc service or its host svchost.exe instance.
New child processes spawned under the Biometric Service context, particularly command interpreters such as cmd.exe or powershell.exe.
Creation or modification of privileged accounts, services, or scheduled tasks shortly after Biometric Service activity by a non-administrative user.

Detection Strategies

Hunt for local privilege escalation patterns where a standard user session is followed by SYSTEM-level process creation traced back to the Biometric Service host process.
Alert on abnormal handle opens or RPC calls targeting Windows Biometric Framework interfaces from user-mode processes that do not normally consume biometric APIs.
Correlate Application and System event log entries referencing WbioSrvc faults with subsequent security-relevant actions such as token manipulation or service installation.

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command-line logging and forward events to a centralized analytics platform.
Monitor the health and crash telemetry of the Biometric Service across endpoints that expose biometric hardware.
Track patch compliance for the affected Windows client and server builds listed in the MSRC advisory.

How to Mitigate CVE-2026-83977

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-83977 as soon as testing permits.
Prioritize patching multi-user hosts, virtual desktop infrastructure, and jump servers where non-administrative users maintain interactive access.
Review local account inventories and remove unnecessary interactive logon rights to reduce the pool of potential local attackers.

Patch Information

Microsoft addresses CVE-2026-83977 through the monthly security update channel. Consult the Microsoft Security Update Guide for the specific KB article and build numbers that apply to each affected Windows 10, Windows 11, and Windows Server release.

Workarounds

On systems that do not use biometric authentication, disable the Windows Biometric Service (WbioSrvc) using sc.exe config WbioSrvc start= disabled and stop the running service.
Restrict local logon and Remote Desktop access on servers to trusted administrators until the patch is deployed.
Enforce application control policies to limit which unprivileged binaries can invoke Windows Biometric Framework APIs on shared hosts.

bash

# Disable the Windows Biometric Service where biometrics are not required
sc.exe stop WbioSrvc
sc.exe config WbioSrvc start= disabled