CVE-2026-73008: Windows Biometric Service Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.
Other sources
Windows Biometric Service Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Windows system and able to access it locally. The provided vector indicates low privileges are required and no user interaction is needed.
What is the impact of successful exploitation?
Successful exploitation can disclose private personal information. The supplied impact metrics indicate high confidentiality impact, with no integrity or availability impact.
Which systems are identified as affected?
The affected software list includes Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025.