Executive brief
Windows Biometric Service is a system component used to authenticate users via fingerprint, facial recognition, and other biometric methods. A null pointer vulnerability in this service allows a local attacker with standard user privileges to crash the service or potentially run arbitrary code with elevated system permissions, bypassing security controls.
Technical details
A null pointer dereference vulnerability exists in the Windows Biometric Service, likely stemming from insufficient input validation or missing pointer checks in the biometric processing code path. The vulnerability requires local access and prior authentication as a standard user. An attacker can craft malicious input to trigger the null pointer dereference, leading to a denial-of-service condition or local privilege escalation depending on exploitation technique. Microsoft has released patches to address this issue.
Affected products
- Microsoft Windows Biometric Service
Timeline
- 2026-09-08: disclosed