CVE-2026-72990

CVE-2026-72990 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Biometric Service, with the CWE mapping also listing CWE-190 (integer overflow or wraparound), indicating a size-calculation error underlies the overflow. An authorized, low-privileged local user can trigger the flaw without any user interaction, causing the service to write past the end of a heap buffer. Successful exploitation allows the attacker to elevate privileges locally, with high impact on the confidentiality, integrity, and availability of the compromised machine. Any Windows system running the Biometric Service is potentially affected, though the provided data does not specify which Windows versions or builds are impacted. There is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns roughly a 0.3% probability of exploitation within 30 days, so no exploitation is currently known.

What to do: Install Microsoft's security update for CVE-2026-72990 via Windows Update as soon as the advisory identifies the affected builds, prioritizing shared, kiosk, or multi-user machines where untrusted users hold local accounts. Because exploitation requires an authorized local session, review and restrict local logon rights on sensitive hosts as an interim measure. No workarounds or public PoC are currently documented.