Improper input validation in Windows BitLocker allows a local attacker to bypass a critical security feature. The flaw can enable manipulation or negation of the encryption safeguards protecting volumes, potentially exposing the data stored on those disks and compromising confidentiality. The weakness, classified as CWE‑20, signifies unsafe handling of input that leads to failure in enforcing protective controls.

Microsoft Windows Server versions 2012, 2012 R2, 2016, 2019, 2022, and the 23H2 edition, including all Server Core installations, are affected as indicated in the advisory.

The CVSS base score of 7.7 reflects a moderate‑to‑high severity. Exploitation requires local presence, meaning the attacker must have user or administrative access on the affected machine to supply the malformed input. No evidence of exploitation exists in the KEV catalog and EPSS data is unavailable, suggesting limited known usage but a potentially significant impact if abused. The local attack vector and necessity for local authority imply that internal threat actors or compromised accounts pose the primary risk.