CVE-2026-83974

CVE-2026-83974 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the Windows component that handles fingerprint, face, and other biometric authentication data. A local attacker who already holds valid low-privilege credentials can send crafted input to the service, overrunning a heap buffer and corrupting adjacent memory without any user interaction. Successful exploitation allows the attacker to elevate privileges, gaining high-level (typically SYSTEM) access with full confidentiality, integrity, and availability impact on the host. Any system running an affected Windows 10 or Windows 11 branch or an affected Windows Server release is in scope; the Biometric Service is present by default on these platforms, with exposure most relevant on systems where biometric logon (Windows Hello) is configured. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not on the CISA KEV list, and EPSS puts 30-day exploitation probability at only 0.2% (16th percentile).

What to do: Apply Microsoft's September 2026 cumulative security updates (Patch Tuesday) to all affected Windows 10, Windows 11, and Windows Server systems; no KB-specific version numbers are provided in this data, so verify remediation against Microsoft's advisory for CVE-2026-83974. Prioritize hosts where local users hold low-privilege accounts and Windows Hello/biometric sign-in is enabled, and check the state of the Windows Biometric Service (WbioSrvc) on servers where it may be running. No public PoC or in-the-wild exploitation is known, so this can be handled in the regular patch cycle, but keep it on the list because local privilege escalations are commonly chained with other flaws.