CVE-2026-72991

CVE-2026-72991 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, a component shipped with Microsoft Windows. An attacker who already holds a low-privileged account on the machine can feed malicious input to the service, corrupting its heap memory without requiring any user interaction. Successful exploitation allows the attacker to elevate privileges locally, with high impact on confidentiality, integrity, and availability of the system. Any Windows installation running the affected component is exposed; the available data does not specify which Windows version ranges are affected, so defenders should consult Microsoft's advisory for the exact builds. Exploitation status is currently quiet: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within the next 30 days.

What to do: Apply Microsoft's Windows security update addressing CVE-2026-72991 as soon as it is available (the provided data does not identify a specific patched build, so track the Microsoft advisory and Windows Update). Because exploitation requires only a standard local account and no user interaction, prioritize patching shared workstations, multi-user hosts, and systems where untrusted users can log on via RDP or local sessions. No public PoC or in-the-wild exploitation is known, so no urgent compensating controls are required beyond routine patching.