{"id":"CVE-2026-88239","kind":"vulnerability","aliases":["CVE-2026-88239"],"related":[],"title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Biometric Service lets a user who already has an account on the machine run code with higher privileges. The sources report a CVSS score of 7.8 but do not describe the exploit path further.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["biometrics","infrastructure","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","triaged_at":"2026-11-10T19:38:36+00:00","updated_at":"2026-11-10T19:38:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Biometric Service lets a user who already has an account on the machine run code with higher privileges. The sources report a CVSS score of 7.8 but do not describe the exploit path further.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","biometrics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-88239 to confirm affected Windows builds, the fixed update, and whether the service needs to be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Machines running the Windows Biometric Service, which handles fingerprint and face sign-in on Windows. The sources do not say which Windows versions are affected or whether the service must be enabled, so the unknown is left as is. An attacker needs an authorized local account first, so systems without untrusted local users carry less risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4494,"output_tokens":483,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the Microsoft advisory for CVE-2026-88239 to confirm affected Windows builds, the fixed update, and whether the service needs to be enabled.","search":"'-2026':14A,17A '-88239':15A,18A '7.8':56B 'account':40B 'allow':73C 'alreadi':37B 'attack':76C 'author':75C 'base':25B,66C 'biometr':2A,19B,31B,71C 'buffer':26B,67C 'code':45B 'cve':13A,16A 'cvss':53B 'describ':60B 'elev':78C 'exploit':62B 'gain':10A 'heap':4A,24B,65C 'heap-bas':23B,64C 'higher':11A,47B 'infrastructur':20B 'let':6A,33B 'local':8A,80C 'machin':43B 'overflow':5A,27B,68C 'path':63B 'privileg':12A,48B,79C 'report':51B 'run':44B 'score':54B 'servic':3A,32B,72C 'sourc':50B 'user':9A,35B 'window':1A,21B,30B,70C","nicknames":[],"mitigations":[],"who_affected":"Machines running the Windows Biometric Service, which handles fingerprint and face sign-in on Windows. The sources do not say which Windows versions are affected or whether the service must be enabled, so the unknown is left as is. An attacker needs an authorized local account first, so systems without untrusted local users carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["biometrics","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88239':15A,18A 'biometr':2A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'servic':3A 'user':9A 'window':1A","search_b":"'7.8':56B 'account':40B 'alreadi':37B 'base':25B 'biometr':19B,31B 'buffer':26B 'code':45B 'cvss':53B 'describ':60B 'exploit':62B 'heap':24B 'heap-bas':23B 'higher':47B 'infrastructur':20B 'let':33B 'machin':43B 'overflow':27B 'path':63B 'privileg':48B 'report':51B 'run':44B 'score':54B 'servic':32B 'sourc':50B 'user':35B 'window':21B,30B","search_c":"'allow':73C 'attack':76C 'author':75C 'base':66C 'biometr':71C 'buffer':67C 'elev':78C 'heap':65C 'heap-bas':64C 'local':80C 'overflow':68C 'privileg':79C 'servic':72C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88239","severity":null,"published_at":"2026-11-10T19:21:33+00:00","modified_at":"2026-11-10T19:21:33+00:00","first_seen_at":"2026-11-10T19:25:20+00:00","fetched_at":"2026-11-10T19:25:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}