CVE-2025-26644

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to perform spoofing locally.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1039

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-266458.8Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.CVE-2025-266468.0External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spo CVE-2025-266478.8Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.CVE-2025-266487.8Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2025-266497.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized a CVE-2025-26659.8A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been classified as critical. This affects an unknow CVE-2025-266516.5Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.CVE-2025-266527.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over CVE-2025-266534.7SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vuln CVE-2025-266546.8SAP Commerce Cloud (Public Cloud) does not allow to disable unencrypted HTTP (port 80) entirely, but instead allows a redirect from port 80 CVE-2025-266553.1SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges th CVE-2025-266564.3OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attac