Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), but lead to no loss of integrity (I:N) or availability (A:N). What does that mean for this vulnerability?
An attacker who successfully exploits this vulnerability cannot modify any sensitive user data or cause user data to become unavailable but can access sensitive user data.
Security updates
10.0.17763.9245 — https://support.microsoft.com/help/5122876
10.0.20348.5622 — https://support.microsoft.com/help/5122882
10.0.19044.7725 — https://support.microsoft.com/help/5122878
10.0.26100.33438 — https://support.microsoft.com/help/5122871
10.0.26200.9445 — https://support.microsoft.com/help/5124008
10.0.22631.7582 — https://support.microsoft.com/help/5122880
10.0.28000.2954 — https://support.microsoft.com/help/5124012
10.0.14393.9512 — https://support.microsoft.com/help/5123099
Vulnerabilities 1
-
Medium 5.5
Windows Biometric Service Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-73008 Windows Biometric Service Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73008
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss