Executive brief
Windows Hello is Microsoft's biometric authentication system used to secure access to Windows devices. A race condition vulnerability allows an authorized local user to execute code with elevated system privileges, potentially compromising device security and enabling malware installation or sensitive data theft.
Technical details
A race condition exists in Windows Hello's shared resource synchronization, allowing concurrent access to a critical section without proper locking mechanisms. An authenticated local attacker can exploit this timing vulnerability to bypass privilege checks and execute arbitrary code with elevated privileges. The vulnerability requires an existing user account on the system; network-based exploitation is not possible. A patch is available from Microsoft Security Response Center.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed