CVE-2026-83985

CVE-2026-83985 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service (WbioSrvc) on supported Windows 10, Windows 11, and Windows Server releases. A local, already-authenticated user with low privileges and no user interaction can trigger the overflow via a crafted request or operation handled by the service. Successful exploitation yields elevated privileges on the local host, with high impact on confidentiality, integrity, and availability — effectively a full local compromise. Any organization or individual running the listed Windows 10/11 client versions or Windows Server 2016–2025 is exposed, though exploitation requires local code execution first. The flaw is not in CISA KEV, has no known public PoC, a modest 0.3% EPSS, and is believed unexploited; it was addressed in Microsoft's September 2026 Patch Tuesday release, which fixed 973 vulnerabilities (two of them already-exploited zero-days, though not this one).

What to do: Apply Microsoft's September 2026 cumulative updates for each affected Windows 10/11 and Windows Server version; verify patch rollout across client fleets, servers, and LTSC/long-term servicing branches such as 1607 and 1809. No workaround is documented, but prioritize hosts where multiple untrusted users can log on locally and audit which machines use Windows Hello biometrics. Patch all systems running the listed versions, including those without biometric hardware, since the service is present by default.