CVE-2026-83977

CVE-2026-83977 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the component that manages fingerprint, face, and other biometric sign-in data. A local attacker who already holds a low-privileged account on a target machine can trigger the overflow by feeding crafted data to the service; the attack requires no user interaction and can succeed unattended. Successful exploitation grants the attacker elevated privileges with high impact on confidentiality, integrity, and availability on the compromised host. Affected releases span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025. As of this analysis there is no known exploitation, no public proof-of-concept, and the flaw is not in CISA's KEV catalog; it was addressed in Microsoft's September 2026 Patch Tuesday (973 vulnerabilities fixed), and is not reported as one of the two exploited zero-days.

What to do: Apply Microsoft's September 2026 security updates (the current cumulative update for each affected release) across Windows 10 1607/1809/21H2/22H2, Windows 11 23H2-26H1, and Windows Server 2016-2025. Until patched, limit local account access on shared or multi-user machines and prioritize endpoints where Windows Hello or fingerprint sign-in is enabled. With no known exploitation, no public PoC, and a low EPSS score (~0.3%), routine patch-cadence remediation is sufficient, but verify the update applied cleanly on biometric-enabled hosts.