The Windows Biometric Service has a heap-based buffer overflow that can be triggered by supplying malformed data to the service. An attacker who has local authorized access can exploit this flaw to overwrite controlled memory and gain elevated privileges on the affected system. The weakness is a classic example of a heap overflow (CWE‑122) that enables local privilege escalation. Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2 and 26H1; and Windows Server releases 2016, 2019, 2022 and 2025, covering both full installations and Server Core editions. The CVSS score of 7.8 denotes high severity, but no EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; the attacker must first obtain some level of authorized access to the machine. Once the buffer overflow is triggered, the attacker can elevate privileges but cannot execute arbitrary code or cause a denial of service from the network.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2 and 26H1; and Windows Server releases 2016, 2019, 2022 and 2025, including both full and Server Core installations.

The high CVSS score indicates potentially serious impact for systems with the flaw, but local permission is required for exploitation. The lack of an EPSS score and absence from KEV suggest exploitation is not currently widespread. Nonetheless, any local attacker with moderate privileges can use the service to step up to higher system rights, thereby gaining the ability to compromise system integrity and confidentiality.