Heap Buffer Overflow in Windows Biometric Service Enables Local Privilege Escalation
AI analysis
CVE-2026-83981 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, addressed by Microsoft in its September 2026 Patch Tuesday release. An authorized local attacker with low privileges can trigger the overflow through the biometric service without any user interaction, corrupting heap memory. Successful exploitation allows the attacker to elevate privileges locally, with the CVSS scoring high impact on confidentiality, integrity, and availability (7.8 High). The flaw affects essentially all currently serviced Windows client lines (Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2/24H2/25H2/26H1) as well as Windows Server 2016 through 2025. There is no public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS estimates only about a 0.3% chance of exploitation in the next 30 days.
What to do: Deploy the September 2026 Windows security updates from Microsoft for all listed Windows 10 and Windows 11 client builds and Windows Server 2016/2019/2022/2025. Prioritize endpoints where users authenticate with Windows Hello fingerprint or facial recognition, since the Biometric Service is actively exercised there; verify via the Windows Update or WSUS patch-compliance reports that all listed builds have received the September 2026 cumulative update. No workarounds or exploited-in-the-wild activity are reported, but the low attack complexity and no-user-interaction vector make this a routine patch-first item rather than an emergency.
Affected
| microsoft Windows 10 | 1607 |
| microsoft Windows 10 | 1809 |
| microsoft Windows 10 | 21H2 |
| microsoft Windows 10 | 22H2 |
| microsoft Windows 11 | 23H2 |
| microsoft Windows 11 | 24H2 |
| microsoft Windows 11 | 25H2 |
| microsoft Windows 11 | 26H1 |
| microsoft Windows Server 2016 | as listed in the September 2026 advisory |
| microsoft Windows Server 2019 | as listed in the September 2026 advisory |
| microsoft Windows Server 2022 | as listed in the September 2026 advisory |
| microsoft Windows Server 2025 | as listed in the September 2026 advisory |
Estimated exposure
masshundreds of millions of Windows devices potentially in scope (Windows 10/11 installed base exceeds 1 billion; the Biometric Service is present by default,… — The affected versions span the entire supported Windows client and server installed base (over a billion Windows devices per public market data), so exposure is mass by deployment share, tempered by the local attack vector and the need for…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.