CVE-2026-81354 – Windows Hello Elevation of Privilege Vulnerability

CVE-2026-81354 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a heap-based buffer overflow. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could submit malformed face data to the Windows Hello Face secure sensor adapter and potentially gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authorized local attacker to cross the VTL0-to-VTL1 security boundary and gain VTL1 privileges. The vulnerability has low attack complexity once the required high privileges or face-sensor adapter control are present. Public disclosure is No, and exploitation is assessed as less likely.

EXPLOITS: There is no confirmed exploitation. The vulnerability is not publicly disclosed, and exploit-code maturity is listed as Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is a CWE-122 heap-based buffer overflow in Windows Hello. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could send malformed face data to the Windows Hello Face secure sensor adapter. Successful exploitation could execute code across the VTL0-to-VTL1 security boundary and provide VTL1 privileges. The CVSS metrics indicate a local attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, including Server Core, across the architectures listed for each release. Exploitation requires administrative OS control or control of a face-sensor adapter and does not require user interaction.

BUSINESS IMPACT: Successful exploitation could enable code execution across an important Windows security boundary with high confidentiality, integrity, and availability impact. For organizations, this could allow an attacker who already has substantial control to extend that access into VTL1, increasing the potential impact of a compromised system.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can cross the VTL0-to-VTL1 security boundary. Although exploitation is assessed as less likely and no exploitation is confirmed, affected Windows systems should receive the official fix promptly because successful exploitation carries high confidentiality, integrity, and availability impact.