CVE-2026-73002

CVE-2026-73002 is an integer overflow/wraparound flaw (CWE-190) in the Windows Biometric Service, the Windows component that supports biometric sign-in such as fingerprint and facial recognition. A local attacker who already holds a low-privileged authorized account can trigger the flaw without any user interaction. Successful exploitation elevates the attacker's privileges locally, and the CVSS impact ratings indicate the resulting compromise exposes high confidentiality, integrity, and availability impact on the host, typically meaning system-level control. Any Windows installation running the affected Biometric Service is potentially exposed, but the flaw is only reachable by code already executing locally, not remotely by itself. There is currently no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.2% probability of exploitation within 30 days, indicating no known exploitation at this time.

What to do: Apply Microsoft's patch for this vulnerability as soon as it is available through Windows Update, prioritizing multi-user hosts, servers, and endpoints where untrusted users can execute code locally, and check Microsoft's advisory for the exact affected builds. Until patched, limit local logon and code-execution rights on shared systems and treat any existing local foothold as a potential path to full privilege escalation; monitor for new PoCs or KEV additions given that local privilege escalation flaws are commonly chained with malware.