Executive brief
Windows Biometric Service, a core Windows component that processes fingerprint and other biometric authentication data, contains a heap-based buffer overflow vulnerability. An authorized local attacker can exploit this flaw to execute arbitrary code with elevated privileges, potentially compromising the entire system or gaining administrative access.
Technical details
A heap-based buffer overflow exists in Windows Biometric Service, allowing an authenticated local attacker to trigger memory corruption by providing malformed input. The vulnerability requires the attacker to have local system access and valid authentication credentials. Successful exploitation permits privilege escalation from a user-level context to a higher privilege level, potentially SYSTEM-level access. Microsoft has released patches to address this vulnerability through standard Windows updates.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed