CVE-2026-83987

CVE-2026-83987 is a heap-based buffer overflow (CWE-122) in the Windows Biometric Service, the component that handles Windows Hello and fingerprint/face authentication requests on Windows. A local attacker who is already authenticated with low-level user rights can send crafted input to the service, triggering the overflow and gaining elevated privileges on the local machine. The vulnerability affects a broad set of Windows 10 and Windows 11 client releases as well as Windows Server 2016 through 2025, meaning virtually the entire supported Windows fleet is in scope. Exploitation requires local access, and there is no indication of remote or unauthenticated attack vectors. As of this analysis, the flaw is not in CISA's KEV catalog, has no known public proof-of-concept, and carries a low EPSS score (0.3% probability of exploitation within 30 days); it was addressed in Microsoft's September 2026 Patch Tuesday release, which fixed 973 vulnerabilities.

What to do: Install Microsoft's September 2026 cumulative security updates for all affected Windows 10, Windows 11, and Windows Server versions. Prioritize endpoints and servers where untrusted or low-privileged users can log on locally (kiosks, shared workstations, multi-user servers), since the flaw is only exploitable by an authenticated local user. Verify the Windows Biometric Service (WbioSvc) update via your patch management reporting rather than relying on version strings alone.