Executive brief
Windows Biometric Service is a core Windows component that manages fingerprint and other biometric authentication methods. A heap buffer overflow in this service allows an authorized attacker to execute arbitrary code and escalate privileges across a network, potentially compromising the security and integrity of Windows systems.
Technical details
A heap-based buffer overflow vulnerability exists in the Windows Biometric Service, a privileged system component responsible for biometric authentication on Windows platforms. The vulnerability can be triggered by an authorized network attacker to write beyond heap buffer boundaries, enabling remote privilege escalation. Exploitation requires the attacker to already have valid credentials or network access to the service. Successful exploitation allows an attacker to execute arbitrary code with elevated system privileges. A security patch is available from Microsoft addressing this issue.
Affected products
- Microsoft Windows Biometric Service <UNKNOWN>
Timeline
- 2026-09-08: disclosed