CVE-2026-72992

CVE-2026-72992 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the OS component that supports fingerprint and facial-recognition sign-in. It can be triggered by an authorized local attacker — meaning someone who already holds a low-privileged account or session on the machine — without requiring user interaction. Successful exploitation allows local elevation of privilege with high impact on confidentiality, integrity, and availability, effectively handing the attacker administrative control of the host. Any Windows installation with the Biometric Service enabled is affected; the specific affected Windows builds are not listed in the available data, so defenders should consult Microsoft's advisory for exact version ranges. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for CVE-2026-72992 via Windows Update as soon as it is available, checking the Microsoft advisory for the exact affected builds. Prioritize shared workstations, kiosks, and multi-user or terminal-server systems where untrusted users hold local accounts, and verify whether Windows Hello/biometric sign-in is enabled on those hosts. Since exploitation requires local low-privileged access, limiting local user accounts and disabling biometric logon where unnecessary can reduce interim risk.