CVE-2026-72996: Windows Biometric Service Elevation of Privilege Vulnerability
Published Sep 8, 2026
·Updated
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
Other sources
Windows Biometric Service Elevation of Privilege Vulnerability
— Microsoft
Affected Software
1 affected component
Microsoft Windows Biometric Service
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
CVE Published
via MITRE·05:17 PM
Data Sourced
via MITRE·05:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Can this be exploited remotely or does it require local access?
The supplied CVSS vector identifies the attack vector as local. An attacker must already have authorized access to the affected Windows system, with low privileges, and no user interaction is required.
2
What could an attacker gain after successful exploitation?
Successful exploitation can elevate the attacker's privileges. The CVSS vector rates confidentiality, integrity, and availability impact as high.