CVE-2026-72997

CVE-2026-72997 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, a built-in Windows component that handles fingerprint, face, and other biometric authentication. A local attacker who already has authorized, low-privileged access to a system can send crafted input to the service to corrupt heap memory and execute code in the service's context. Successful exploitation yields a full local privilege escalation, giving the attacker high confidentiality, integrity, and availability impact — effectively administrative/SYSTEM-level control of the host. Any Windows system running the affected Biometric Service component is exposed, with the precise affected Windows versions defined in Microsoft's advisory. Exploitation status: none known — there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Track Microsoft's advisory and apply the patch for CVE-2026-72997 as soon as it is released via Windows Update/WSUS, prioritizing multi-user systems where local privilege escalation has the greatest impact (RDS hosts, shared workstations, kiosks, and VDI). Until patching, apply least-privilege practices by limiting which users can log on locally to sensitive machines, and verify the Biometric Service is enabled/running on hosts you need to triage. Because no public PoC or in-the-wild exploitation is known, routine Patch Tuesday remediation is sufficient rather than emergency patching.