CVE-2026-69323

CVE-2026-69323 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, a built-in Windows component. A low-privileged, already-authorized local attacker can trigger the flaw without user interaction by interacting with the service in a way that overflows a heap buffer. Successful exploitation lets the attacker elevate privileges locally, gaining high integrity-level access with potential for full confidentiality, integrity, and availability impact on the host. Any Windows system running the Biometric Service is affected, with shared or multi-user Windows hosts and kiosks the most meaningful attack surface since exploitation requires local access. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is currently reported, and EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Install Microsoft's security update addressing CVE-2026-69323 as soon as it is available, prioritizing shared Windows hosts, kiosks, and remote-workstation servers where untrusted users hold local logon rights. As an interim check, determine whether the Biometric Service (WbioSrvc) is running on high-risk hosts and consider disabling it on systems that do not use Windows Hello or other biometric sign-in features. No public PoC or KEV listing exists yet, so routine patch-cycle handling is reasonable for single-user endpoints.