Skip to content
OpenAdvisories
Medium · 5.1 CVE-2025-26644 EUVD-2025-10237GHSA-2f5r-r4jx-hh42

Windows Hello Spoofing Vulnerability

Published Apr 8, 2025 · Updated Aug 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 1809 Product: Windows 10 Version 21H2 Product: Windows 10 Version 22H2 Product: Windows 11 version 22H2 Product: Windows 11 version 22H3 Product: Windows 11 version 23H2 Product: Windows 11 Version 24H2 Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.

Affected products

VendorProductAffectedFixed
Microsoft Windows 10 Version 1809 10.0.17763.0 – < 10.0.17763.7136 10.0.17763.7136
Microsoft Windows 10 Version 21H2 10.0.19044.0 – < 10.0.19044.5737 10.0.19044.5737
Microsoft Windows 10 Version 22H2 10.0.19045.0 – < 10.0.19045.5737 10.0.19045.5737
Microsoft Windows 11 version 22H2 10.0.22621.0 – < 10.0.22621.5189 10.0.22621.5189
Microsoft Windows 11 version 22H3 10.0.22631.0 – < 10.0.22631.5189 10.0.22631.5189
Microsoft Windows 11 Version 23H2 10.0.22631.0 – < 10.0.22631.5189 10.0.22631.5189
Microsoft Windows 11 Version 24H2 10.0.26100.0 – < 10.0.26100.3775 10.0.26100.3775
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.7136 10.0.17763.7136
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.7136 10.0.17763.7136
Microsoft Windows Server 2025 10.0.26100.0 – < 10.0.26100.3775 10.0.26100.3775
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.0 – < 10.0.26100.3775 10.0.26100.3775

Advisories 3

References