CVE-2026-73020

CVE-2026-73020 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the in-box Windows component that processes biometric sign-in data such as Windows Hello fingerprint and facial recognition. A local attacker who already holds low-privilege access can send crafted input to the service, overrunning a heap buffer and corrupting adjacent memory. Successful exploitation lets the attacker elevate privileges on that machine, producing high confidentiality, integrity, and availability impact — effectively full control of the host. Any Windows installation running the affected builds of the Windows Biometric Service is exposed, with the specific affected Windows version ranges enumerated in Microsoft's advisory. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns it a 0.2% probability of exploitation within 30 days.

What to do: Patch via Windows Update by installing the Microsoft security/cumulative update that addresses CVE-2026-73020, and confirm applicability against the affected-version list in Microsoft's advisory. As an interim measure on shared or multi-user hosts, restrict local logon and interactive access to trusted users, since the flaw requires an existing low-privilege local session. Monitor Microsoft's advisory and this dashboard for any emergence of public PoCs or in-the-wild exploitation.