Windows Biometric Service: Elevation of privilege via heap-based buffer overflow

Summary

A heap-based buffer overflow (CWE-122) in the Windows Biometric Service allows an authorized local attacker to elevate privileges. The attacker needs a low-privilege account on the affected system and local access, so this is a post-compromise escalation step rather than an entry point from the internet. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the device.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 before 10.0.14393.9512)
• Windows 10 Version 1809 (builds 10.0.17763.0 before 10.0.17763.9245)
• Windows 10 Version 21H2 (builds 10.0.19044.0 before 10.0.19044.7725)
• Windows 10 Version 22H2 (builds 10.0.19045.0 before 10.0.19045.7725)
• Windows 11 Version 23H2 (builds 10.0.22631.0 before 10.0.22631.7582)
• Windows 11 Version 24H2 (builds 10.0.26100.0 before 10.0.26100.9445)
• Windows 11 Version 25H2 (builds 10.0.26200.0 before 10.0.26200.9445)
• Windows 11 Version 26H1 (builds 10.0.28000.0 before 10.0.28000.2954)
• Windows Server 2016, including Server Core (builds 10.0.14393.0 before 10.0.14393.9512)
• Windows Server 2019, including Server Core (builds 10.0.17763.0 before 10.0.17763.9245)
• Windows Server 2022 (builds 10.0.20348.0 before 10.0.20348.5622)
• Windows Server 2025 (build range listed as 10.0.26100.0 before 10.0.26100.33438; conflicts with the 24H2 entry, to be verified)

Fixed in

• Windows 10 1607 / Server 2016: 10.0.14393.9512
• Windows 10 1809 / Server 2019: 10.0.17763.9245
• Windows 10 21H2: 10.0.19044.7725
• Windows 10 22H2: 10.0.19045.7725
• Windows 11 23H2: 10.0.22631.7582
• Windows 11 24H2: 10.0.26100.9445
• Windows 11 25H2: 10.0.26200.9445
• Windows 11 26H1: 10.0.28000.2954
• Windows Server 2022: 10.0.20348.5622
• Windows Server 2025: 10.0.26100.33438 (to be verified against MSRC)

The build numbers are taken from the CVE record and must be confirmed in the MSRC Security Update Guide before rollout.

Workaround

Unknown.

No vendor-documented workaround was found. Install the cumulative update containing the fixed build.

Exploitation

• No evidence of exploitation in the wild was found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept was found at the time of research.

Our recommendation

• Inventory Windows endpoints and servers that use Windows Biometric Service, especially shared workstations and terminals with biometric sign-in.
• Confirm the installed build numbers against the MSRC advisory and apply the cumulative update containing the fixed build, prioritizing older Windows 10 builds and shared devices.
• Limit local accounts and restrict users from running unapproved code, to reduce the risk of local escalation after phishing.
• Monitor for unusual privilege changes and re-check MSRC and CISA KEV for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88239 msrc.microsoft.com
• CVE Record CVE-2026-88239 (CVE.org) www.cve.org
• Strix AI mirror: CVE-2026-88239 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:15.