A heap-based buffer overflow in the Windows Biometric Service permits an attacker with local, authenticated access to execute code with elevated privileges. The flaw is a classic memory corruption bug that can allow the attacker to take control of the process and perform actions normally restricted to administrators. This type of zero‑day vulnerability can compromise system integrity, potentially enabling malicious users to install software, change configurations, or exfiltrate data. The weakness is classified as CWE-122, indicating a classic buffer overflow. The impact on a system with the service running is that any authenticated user can elevate their credentials to that of higher privilege, potentially an administrator, thereby enabling full control over that host.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 editions 23H2, 24H2, 25H2, and 26H1; Microsoft Windows Server 2016, Server 2019, Server 2022, and Server 2025, including server core installations. All affected platforms run the Windows Biometric Service component, which is susceptible to the vulnerability.

The CVSS score of 7.8 reflects a high severity local privilege escalation scenario, while the EPSS score is not available, suggesting no publicly known exploit at this time. The vulnerability is not listed in CISA KEV, implying no known active exploitation campaigns. Nonetheless, because the flaw permits a local attacker an approved user account to elevate privileges on the same host, the risk is significant for organizations that rely on Windows Biometric Service for authentication. The likely attack vector is local, requiring authorized or pre‑existing user credentials, meaning any compromised or adversary-controlled user can exploit the flaw without additional network access.