Windows Biometric Service: Heap-based buffer overflow allows local privilege escalation

Summary

The Windows Biometric Service in several Windows 10, Windows 11 and Windows Server versions contains a heap-based buffer overflow (CWE-122). An authorized local user with low privileges can exploit it to elevate privileges on the affected system. No user interaction is required, but the attacker needs prior local access, for example through a phished or stolen low-privilege account. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9512)
• Windows 10 Version 1809 (builds before 10.0.17763.9245)
• Windows 10 Version 21H2 (builds before 10.0.19044.7725)
• Windows 10 Version 22H2 (builds before 10.0.19045.7725)
• Windows 11 Version 23H2 (builds before 10.0.22631.7582)
• Windows 11 Version 24H2 (builds before 10.0.26100.9445)
• Windows 11 Version 25H2 (builds before 10.0.26200.9445)
• Windows 11 Version 26H1 (builds before 10.0.28000.2954)
• Windows Server 2016, including Server Core (builds before 10.0.14393.9512)
• Windows Server 2019, including Server Core (builds before 10.0.17763.9245)
• Windows Server 2022 (builds before 10.0.20348.5622)
• Windows Server 2025 (builds before 10.0.26100.33438)

Fixed in

• Install the Microsoft security update that brings the builds listed above to their fixed versions. The KB numbers are unknown and must be taken from the MSRC Security Update Guide.
• Note: the fixed build for Windows 11 24H2 (10.0.26100.9445) differs from the one for Windows Server 2025 (10.0.26100.33438). Verify both on MSRC.

Workaround

Unknown. No vendor workaround was found in the sources. Patching is the fix.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No evidence of exploitation in the wild was found.
• Public proof-of-concept code: unknown.

Our recommendation

• Inventory Windows hosts and record their build numbers.
• Patch affected systems with the November 2026 cumulative update after confirming the KB and fixed build on the MSRC advisory. Prioritize Windows 10 1607/1809/21H2 and Windows Server 2016/2019, which are the oldest builds.
• Restrict local logon on servers and shared workstations, and limit low-privilege accounts.
• Re-check the NVD record and CISA KEV for changes, as NVD was still awaiting analysis at publication.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft CNA record (CVE.org) www.cve.org
• MSRC Security Update Guide msrc.microsoft.com
• strix.ai aggregator entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 03:11.