CVE-2026-83971

CVE-2026-83971 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the Windows component that manages fingerprint, facial-recognition, and other biometric authentication. An attacker who already holds a valid, low-privileged account on the machine can trigger the overflow through the service locally; no remote access or user interaction is required. Successful exploitation elevates the attacker's privileges on that local system, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 7.8). Any organization or user running the affected Windows releases - Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025 - is exposed, though exploitation requires local access to the device. There is currently no evidence of exploitation in the wild: the flaw is not in CISA's KEV catalog, no public proof-of-concept is known, and EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile).

What to do: Install Microsoft's security update for CVE-2026-83971 via Windows Update, WSUS, or your patch-management tooling on all affected Windows 10, Windows 11, and Windows Server releases, and confirm the fix arrives in your next cumulative update cycle. Until patched, prioritize hosts that allow logon by untrusted or multiple users - shared workstations, kiosks, VDI and Remote Desktop Session hosts - and consider limiting biometric sign-in or the Windows Biometric Service where it is not required as an interim mitigation. Given no known exploitation, no public PoC, and low EPSS, standard patch cadence is defensible, but treat shared or multi-user systems as higher priority.