CVE-2026-72941

CVE-2026-72941 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Biometric Service. A local attacker who already holds low-privileged credentials on a Windows machine can trigger the flaw by getting the service to process malformed input, corrupting heap memory. Successful exploitation allows the attacker to elevate privileges on the affected host, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8). Any Windows system running the affected Windows Biometric Service builds is exposed to this local escalation path; no exploitation is currently known, there is no public PoC, EPSS is a low 0.3%, and the issue is not in CISA KEV.

What to do: Apply Microsoft's security update for this CVE as soon as it is available via Windows Update and consult Microsoft's advisory for the list of affected builds. Until patched, limit local logon rights to trusted users, and if biometric sign-in (Windows Hello) is not used, consider disabling the Windows Biometric Service to shrink the attack surface.