CVE-2026-73001

CVE-2026-73001 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, a built-in Windows component that handles biometric authentication such as Windows Hello. A low-privileged, authorized local attacker can trigger the flaw by interacting with the service, and the CVSS vector confirms no user interaction and no remote access are required. Successful exploitation lets the attacker elevate privileges on the local machine with high impact on confidentiality, integrity, and availability, which on Windows typically means gaining elevated rights beyond the compromised account. Any Windows system running the affected Biometric Service code is in scope; Microsoft has not published the affected build ranges in the available data, so consult Microsoft's advisory. Exploitation status is quiet: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%.

What to do: Track Microsoft's advisory for CVE-2026-73001 and apply the corresponding Windows security update as soon as it is released, since no fixed build numbers are available in the current data. Given the lack of a public PoC, absence from CISA KEV, and low EPSS, this can follow your normal monthly patch cycle rather than emergency patching, but prioritize it because Windows local privilege escalations are frequently chained with other flaws for full compromise. On endpoints, confirm whether biometric sign-in (Windows Hello / the WbioSrvc service) is in use; where it is not needed, consider disabling it as an interim risk reduction.