A race condition exists in the Windows Biometric Service that allows an attacker to perform concurrent operations on a shared resource. By exploiting this improper synchronization, an attacker with physical access to the device can bypass the configured security checks and cause the system to accept biometric data without proper authentication. This flaw enables an unauthorized user to gain access to the affected machine, potentially elevating privileges or accessing protected information.

The vulnerability is present in Microsoft Windows operating systems and affects the following releases: Windows 10 version 1809, 21H2, 22H2; Windows 11 version 23H2, 24H2, 25H2, 26H1, 22H3; and Windows Server releases 2019, 2022, 2025, and the 23H2 edition, both full and Server Core installations.

The CVSS base score of 6.1 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, yet exploitation requires direct, physical presence on the target device. An attacker can trigger the race condition by submitting multiple biometric requests simultaneously, thereby bypassing authentication checks. The overall risk is moderate, but the possibility of gaining unauthorized access justifies prompt remediation.