Product:
Windows Hello
Summary
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. This vulnerability can lead to significant security risks as it affects the integrity and confidentiality of the system. Attackers can exploit this flaw without needing any privileges, making it particularly dangerous.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2026-20804 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. Once they gain access, they can manipulate the privilege assignments within Windows Hello, allowing them to perform unauthorized actions. The low complexity of the attack means that even individuals with minimal technical skills could potentially exploit this flaw if they have physical access to the device.
Affected Products
- Windows Hello: A biometric authentication feature in Windows that allows users to log in using facial recognition or fingerprints.
Mitigation
To mitigate this vulnerability, users should ensure that their systems are updated with the latest security patches from Microsoft. Additionally, restricting physical access to devices and implementing strong security policies can help prevent unauthorized tampering.