CVE-2026-70572

CVE-2026-70572 is an integer overflow/wraparound flaw (CWE-190) in the Windows Biometric Service, the Windows component that handles fingerprint and Windows Hello authentication. An attacker who already has a low-privileged, authorized account and can execute code locally on a target machine can trigger the flaw, which requires no user interaction. Successful exploitation elevates the attacker's privileges on the local machine, with high impact on confidentiality, integrity, and availability per the CVSS scoring. Any Windows system running the Biometric Service is potentially affected, with devices that have biometric hardware (fingerprint readers or Windows Hello cameras) being the most relevant population. As of now there is no known exploitation: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days (25th percentile).

What to do: Apply Microsoft's security update for CVE-2026-70572 via Windows Update across the estate as soon as it is available, prioritizing multi-user, kiosk, and shared systems where untrusted users hold local accounts. In the interim, inventory endpoints with Windows Hello/biometric logon enabled and restrict local interactive access on shared machines. Because exploitation is not yet observed, no workaround is required beyond timely patching and standard privilege-escalation monitoring.