This vulnerability is a protection mechanism failure in Windows BitLocker that permits an attacker with physical access to bypass TPM‑based enforcement and gain unauthorized access to volumes encrypted by BitLocker. The weakness is a CWE‑306 Authentication Bypass flaw. By exploiting the flaw an adversary can read the protected data, thereby compromising confidentiality. Based on the description, it is inferred that the flaw does not facilitate remote code execution, privilege escalation beyond the local context, or disclosure of decrypted data outside the device.

Affected systems include Microsoft Windows 10 releases from version 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 releases from 23H2 through 26H1; and Microsoft Windows Server editions from 2012 R2 through 2025, including Server Core installations. All processor architectures (x86, x64, ARM64) and full or Server Core installations are impacted, as specified in the CNA vendor/product list.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of 5% reflects a moderate likelihood of exploitation. Based on the requirement for physical device access, it is inferred that remote exploitation is unlikely. There is no reported active exploitation in the CISA KEV catalog. It is inferred that the likely attack vector involves direct physical intrusion or privileged penetration‑testing that manipulates the BitLocker state.