The vulnerability stems from missing authentication in a critical BitLocker function, allowing an attacker with physical access to bypass the encryption controls. This flaw lets the attacker read, modify, or delete data on encrypted volumes without needing conventional privilege escalation, compromising both confidentiality and integrity of the stored information.

Affected systems include Microsoft Windows 10 releases from 1607, 1809, 21 H2 and 22 H2; Windows 11 releases from 23 H2 through 26 H1; and Windows Server editions from 2012 R2 through 2025, including Server Core installations, across x86, x64 and ARM64 architectures.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of 5 % suggests a low to moderate likelihood of exploitation. Physical access is required, making remote exploitation unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits in the wild. If exploited, an attacker could compromise data contained on BitLocker‑protected volumes without necessarily elevating privileges beyond the local user’s context.