This vulnerability (CVE-2026-32088) involves a race condition (CWE-362) in the Windows Biometric Service on Windows 10 Version 1809 (build 10.0.17763.0). Improper synchronization during concurrent execution of shared resources enables an attacker with physical access to bypass security controls. The issue is recognized and addressed by Microsoft with an official patch. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), low attack complexity (AC:L), no privileges or user interaction, and impacts confidentiality and integrity with high severity. Availability is not affected. No known exploits are reported in the wild as of the publication date.

An attacker with physical access to a system running the affected Windows 10 Version 1809 can exploit this race condition to bypass security features of the Windows Biometric Service, potentially compromising confidentiality and integrity of biometric authentication data or related security mechanisms. There is no impact on system availability. No known active exploitation has been reported.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32088 to remediate this vulnerability.