CVE-2026-69593

CVE-2026-69593 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the built-in Windows component that handles biometric authentication such as Windows Hello. A local attacker who already has low-privileged access on the machine can trigger the flaw without any user interaction, corrupting heap memory in the service. Successful exploitation allows the attacker to elevate privileges locally, gaining high impact on the confidentiality, integrity and availability of the host. Any Windows installation running the Biometric Service is in scope, with Microsoft's advisory (CNA: [email protected]) listing the affected releases. As of now there is no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS puts 30-day exploitation probability at just 0.3% (25th percentile), indicating no known exploitation.

What to do: Apply Microsoft's security update for CVE-2026-69593 as it becomes available, prioritizing multi-user hosts such as RDS servers, shared workstations and kiosks where local privilege escalation is most valuable. Until systems are patched, restrict interactive/local logon rights on sensitive machines and confirm which endpoints use Windows Hello or other biometric sign-in, since those are the primary attack surface. Check Microsoft's advisory for the precise affected version list before scanning or prioritizing.