CVE-2026-73021

Microsoft has disclosed a heap-based buffer overflow (CWE-122, preceded by improper input validation, CWE-20) in the Windows Biometric Service, the operating-system component that handles fingerprint and other biometric authentication. The flaw is triggered by malformed data processed by the service, and an attacker who already holds a low-privileged local account can exploit it without any user interaction. Successful exploitation allows the attacker to elevate privileges on the local machine, with high impact on confidentiality, integrity and availability — effectively broader control of the host. Any Windows deployment that includes the Biometric Service is affected; Microsoft (the assigned CNA) has published the advisory, though specific affected Windows build numbers are not included in the available data. There is currently no known public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days, indicating low near-term exploitation risk.

What to do: Apply Microsoft's security update for the Windows Biometric Service via Windows Update as soon as it is available, and consult Microsoft's advisory for the specific affected and fixed builds (not listed in the source data). Because exploitation requires an existing low-privileged local session, prioritize multi-user workstations, jump servers, and VDI/shared environments where local accounts are common. No public PoC or KEV listing exists and EPSS is low, so standard patch cadence is reasonable for isolated single-user endpoints.