CVE-2026-83980: Windows Biometric Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.
Other sources
Windows Biometric Service Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Windows system and able to execute locally. The vulnerability is not described as remotely exploitable and does not require user interaction.
Which systems should be prioritized for review?
Review Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems. The issue affects the Windows Biometric Service and can result in elevation of privilege with high impact to confidentiality, integrity, and availability.
What is the immediate risk if a system is vulnerable?
A local authorized attacker could exploit a heap-based buffer overflow in the Windows Biometric Service to elevate privileges. This could give the attacker greater control over the affected system than their existing account permits.