A heap-based buffer overflow in Windows Biometric Service permits an attacker who already has a local account to gain higher privileges. The flaw originates from improper bounds checking when handling biometric data, allowing an attacker to corrupt memory and execute arbitrary code. The resulting impact is local elevation of privilege, which could enable the attacker to read sensitive data, modify system settings, or further compromise the host.

Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; Windows Server 2016, 2019, 2022, 2025 including Server Core installations. All affected builds are listed by Microsoft.

The CVSS score of 7.8 indicates a high severity for a local privilege escalation. No EPSS information is available, so current exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active widespread exploitation. The attack vector requires an attacker to already be authenticated on the host; however, once authenticated, exploitation is straightforward due to the lack of additional safeguards and the presence of a classic overrun bug.