{"id":"CVE-2026-96127","kind":"vulnerability","aliases":["CVE-2026-96127"],"related":[],"title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.","summary":"A heap-based buffer overflow in the Windows Biometric Service lets an attacker who already has a local account raise their privileges. The sources do not name affected Windows versions or a fix.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","windows"],"not_affected_if":[],"how_to_check":"Unknown build list. Confirm the November 2026 cumulative update (released 2026-11-10) is installed on each Windows host: run 'Get-HotFix' or check Settings > Windows Update > Update history. Look up this CVE in the Microsoft Security Update Guide for the exact KB per Windows version.","fix":"Install the November 2026 Windows security update (MSRC lists this CVE in it). Exact KB numbers and builds are not yet read from a Microsoft page.","status":"open","published_at":"2026-11-10T19:22:10+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","triaged_at":"2026-11-10T19:36:26+00:00","updated_at":"2026-11-10T20:07:41+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:36:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Biometric Service heap overflow lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Biometric Service lets an attacker who already has a local account raise their privileges. The sources do not name affected Windows versions or a fix.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-96127 to confirm affected Windows builds, the patch and the mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Only Windows machines where a local user with some access could reach the Windows Biometric Service are relevant. The sources do not list affected Windows builds or whether the service is enabled by default, so the exposure is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000654,"input_tokens":4494,"output_tokens":410,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-96127 to confirm affected Windows builds, the patch and the mitigation.","search":"'-2026':14A,17A '-96127':15A,18A 'account':40B 'affect':49B 'allow':64C 'alreadi':36B 'attack':34B,67C 'author':66C 'base':24B,57C 'biometr':2A,30B,62C 'buffer':25B,58C 'cve':13A,16A 'elev':69C 'fix':54B 'gain':10A 'heap':4A,23B,56C 'heap-bas':22B,55C 'higher':11A 'infrastructur':19B 'let':6A,32B 'local':8A,39B,71C 'name':48B 'overflow':5A,26B,59C 'privileg':12A,43B,70C 'rais':41B 'servic':3A,31B,63C 'sourc':45B 'user':9A 'version':51B 'window':1A,20B,29B,50B,61C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines where a local user with some access could reach the Windows Biometric Service are relevant. The sources do not list affected Windows builds or whether the service is enabled by default, so the exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96127':15A,18A 'biometr':2A 'cve':13A,16A 'gain':10A 'heap':4A 'higher':11A 'let':6A 'local':8A 'overflow':5A 'privileg':12A 'servic':3A 'user':9A 'window':1A","search_b":"'account':40B 'affect':49B 'alreadi':36B 'attack':34B 'base':24B 'biometr':30B 'buffer':25B 'fix':54B 'heap':23B 'heap-bas':22B 'infrastructur':19B 'let':32B 'local':39B 'name':48B 'overflow':26B 'privileg':43B 'rais':41B 'servic':31B 'sourc':45B 'version':51B 'window':20B,29B,50B","search_c":"'allow':64C 'attack':67C 'author':66C 'base':57C 'biometr':62C 'buffer':58C 'elev':69C 'heap':56C 'heap-bas':55C 'local':71C 'overflow':59C 'privileg':70C 'servic':63C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96127","severity":null,"published_at":"2026-11-10T19:22:10+00:00","modified_at":"2026-11-10T19:22:10+00:00","first_seen_at":"2026-11-10T19:25:31+00:00","fetched_at":"2026-11-10T19:25:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96127:2610","url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96127","severity":null,"published_at":"2026-11-10T20:07:41+00:00","modified_at":"2026-11-10T20:07:41+00:00","first_seen_at":"2026-11-10T20:07:41+00:00","fetched_at":"2026-11-10T20:07:41+00:00","note":"MSRC CVRF API lists the CVE in the November 2026 Security Updates (released 2026-11-10). The MSRC page is JS-only and the CVRF document came back empty, so affected builds, KBs and mitigations are unconfirmed. Nothing verified. Sibling Biometric Service CVEs from Sep 2026 are rated Important, Exploitation Unlikely or Less Likely; that does not apply to this CVE. Revisit when the Update Guide page renders or the CSAF/CVRF data has the KBs.","cites":["https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96127"]}],"documents":[{"id":117690,"url":"https://api.msrc.microsoft.com/cvrf/v3.0/updates/CVE-2026-96127","title":"MSRC API: CVE-2026-96127 listed in November 2026 Security Updates","kind":"advisory","source":"analyst","publisher":null,"text":"MSRC CVRF API returns one update for CVE-2026-96127: 2026-Nov, November 2026 Security Updates, released 2026-11-10T08:00:00Z. No affected builds or KB numbers in this response.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}