{"id":"CVE-2026-95877","kind":"vulnerability","aliases":["CVE-2026-95877"],"related":[],"title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Biometric Service lets a user who already has access to the machine overwrite memory. An attacker can use it to elevate their privileges on that machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":["no-local-accounts-untrusted"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:38:27+00:00","updated_at":"2026-11-10T19:38:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:38:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Biometric Service lets a user who already has access to the machine overwrite memory. An attacker can use it to elevate their privileges on that machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95877 for affected Windows builds and the patch.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-accounts-untrusted"],"who_is_affected":"Only Windows machines running the Windows Biometric Service are in scope, and the attacker needs an authorized local account first. The sources do not name affected Windows builds or the fixed version. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":4494,"output_tokens":415,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-95877 for affected Windows builds and the patch.","search":"'-2026':14A,17A '-95877':15A,18A 'access':38B 'allow':65C 'alreadi':36B 'attack':45B,68C 'author':67C 'base':24B,58C 'biometr':2A,30B,63C 'buffer':25B,59C 'cve':13A,16A 'elev':50B,70C 'gain':10A 'heap':4A,23B,57C 'heap-bas':22B,56C 'higher':11A 'infrastructur':19B 'let':6A,32B 'local':8A,72C 'machin':41B,55B 'memori':43B 'overflow':5A,26B,60C 'overwrit':42B 'privileg':12A,52B,71C 'servic':3A,31B,64C 'use':47B 'user':9A,34B 'window':1A,20B,29B,62C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines running the Windows Biometric Service are in scope, and the attacker needs an authorized local account first. The sources do not name affected Windows builds or the fixed version. unknown","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95877':15A,18A 'biometr':2A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'servic':3A 'user':9A 'window':1A","search_b":"'access':38B 'alreadi':36B 'attack':45B 'base':24B 'biometr':30B 'buffer':25B 'elev':50B 'heap':23B 'heap-bas':22B 'infrastructur':19B 'let':32B 'machin':41B,55B 'memori':43B 'overflow':26B 'overwrit':42B 'privileg':52B 'servic':31B 'use':47B 'user':34B 'window':20B,29B","search_c":"'allow':65C 'attack':68C 'author':67C 'base':58C 'biometr':63C 'buffer':59C 'elev':70C 'heap':57C 'heap-bas':56C 'local':72C 'overflow':60C 'privileg':71C 'servic':64C 'window':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95877","severity":null,"published_at":"2026-11-10T19:21:40+00:00","modified_at":"2026-11-10T19:21:40+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}