CVE-2026-83982

CVE-2026-83982 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Biometric Service, rated 7.8 (High) on CVSS 3.1 for local privilege escalation. A local, low-privileged ('authorized') user can trigger the overflow by getting the service to mishandle crafted input, with no user interaction required. Successful exploitation yields code execution in the service's elevated context, giving the attacker higher privileges on the local host with high impact on confidentiality, integrity, and availability. All unpatched installations of the listed Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2016, 2019, 2022, 2025) releases are affected. No public proof-of-concept or in-the-wild exploitation is known: EPSS is 0.3% (25th percentile), it is not in CISA KEV, and it is not one of the two zero-days Microsoft reported as actively exploited in its September 2026 Patch Tuesday release.

What to do: Apply Microsoft's September 2026 security updates (or later) across all listed Windows 10, Windows 11, and Windows Server systems, and verify hosts are on a patched build per Microsoft's advisory. Prioritize systems where untrusted or unprivileged users log on interactively - VDI, kiosks, shared workstations, and RDS/terminal servers - since exploitation requires only an authenticated local account. With no public PoC or known exploitation, routine patch cadence is acceptable, but do not defer on multi-user hosts.