CVE-2026-72993

CVE-2026-72993 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the Windows component that brokers Windows Hello fingerprint, face, and credential operations. A local attacker who already holds a low-privileged account on the machine can trigger the overflow by sending crafted input to the service, with no user interaction required (CVSS 3.1: AV:L/AC:L/PR:L/UI:N). Successful exploitation lets the attacker elevate privileges locally, with high impact on confidentiality, integrity, and availability — effectively gaining SYSTEM-level control of the host. All Windows systems running the affected builds are technically exposed, but practical reach is limited because the attacker must already be able to execute code locally on the target. As of now there are no public proof-of-concept exploits, the flaw is not in the CISA KEV catalog, and EPSS assigns only a 0.2% probability of exploitation within 30 days, so no exploitation is known.

What to do: Apply Microsoft's security update for CVE-2026-72993 via the next cumulative Windows update, and check Microsoft's advisory for the exact affected builds since the data does not specify version ranges. Prioritize shared, multi-user, and kiosk/VDI endpoints where untrusted users hold local accounts, as those best match the local privilege escalation scenario. Given the absence of public PoCs, KEV listing, and low EPSS, patching on the regular update cycle is a reasonable cadence for single-user endpoints.