CVE-2026-73000

CVE-2026-73000 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the built-in Windows component that handles fingerprint and face authentication (Windows Hello). A local attacker who already has a low-privileged account on a machine can send crafted input to the service, overrunning a heap buffer and gaining the ability to execute code with elevated privileges. Successful exploitation yields full compromise of the local system (high confidentiality, integrity, and confidentiality-adjacent impact under the CVSS vector). Any Windows system with the Biometric Service component is affected; because the service ships with Windows, the potentially affected population is very large, though exploitation requires local access rather than network exposure. There is currently no public proof of concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Apply Microsoft's security update for this CVE via Windows Update as soon as it is available; the source data does not identify specific fixed builds, so check Microsoft's advisory for the affected/fixed version list for your Windows release. No workarounds are documented, but prioritizing patching on shared and multi-user systems (where local attackers are most plausible) is prudent, and monitor for updates since local privilege escalations are frequently chained with remote code execution flaws. No public PoC or in-the-wild exploitation is known at this time.