Product:
Windows Hello
Summary
Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. This vulnerability can lead to significant security risks as it affects the integrity and confidentiality of the system. Attackers can exploit this flaw without needing any privileges or user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.7 | CVE-2026-20852 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected system. By leveraging the incorrect privilege assignment, the attacker can manipulate the Windows Hello functionality to perform unauthorized actions. This can lead to unauthorized access to sensitive information or system settings.
Affected Products
- Windows Hello: A biometric authentication feature that allows users to log in using facial recognition or fingerprints.
Mitigation
To mitigate this vulnerability, users should ensure that their systems are updated with the latest security patches from Microsoft. Additionally, implementing strict access controls and monitoring local access can help reduce the risk of exploitation.