Microsoft Windows Hello Spoofing Vulnerability

A spoofing vulnerability has been identified in Windows Hello, affecting multiple versions of Windows 10, Windows 11, Windows Server 2019, and Windows Server 2025. This vulnerability arises from an automated recognition mechanism that inadequately detects or handles adversarial input perturbations, allowing an unauthorized attacker to perform spoofing locally.

Impact

Exploitation of this vulnerability could lead to unauthorized spoofing, allowing an attacker to impersonate another user or entity.

Remediation

Users can apply the security updates provided in the Microsoft Update Catalog. Specific update details can be found in the Microsoft Knowledge Base articles KB5055518, KB5055519, KB5055523, and KB5055528.