Executive brief
Windows Hello is Microsoft's biometric authentication system used to secure user access to Windows devices. A race condition in the shared resource synchronization allows an authorized local attacker to execute code with elevated privileges, potentially gaining full system control and bypassing security controls.
Technical details
This vulnerability is a classic race condition (CWE-362) in Windows Hello's synchronization of shared resources, allowing concurrent execution to create a time-of-check-time-of-use (TOCTOU) window. The attack requires prior authorization and local access to the system. An attacker can exploit the unsynchronized resource access to escalate from user privileges to system/administrator level. A patch has been released by Microsoft as of the published date (2026-09-08).
Affected products
- Microsoft Windows Hello <UNKNOWN>
Timeline
- 2026-09-08: published