CVE-2026-81354 – Windows Hello Elevation of Privilege Vulnerability
CVSS 8.2
IMPORTANT
Critical - Same Day Deployment
“A malformed face-data request could turn existing administrative control into access across a critical Windows security boundary.”
CVE-2026-81354 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a heap-based buffer overflow. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could submit malformed face data to the Windows Hello Face secure sensor adapter and potentially gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.
Key Details
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-122
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.