A heap‑based buffer overflow exists in the Windows BitLocker implementation. When triggered, the flaw allows an attacker who already has authorized clearance to inject and execute arbitrary code on the affected system. The vulnerability falls under CWE‑122 and can compromise confidentiality, integrity, and availability by allowing unauthorized code to run with the privileges of the BitLocker process.

Microsoft Windows operating systems including Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) are affected.

The CVSS score is 6.7, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not currently observed. Exploitation requires local authorization, so the attack surface is confined to users or processes with administrative privileges who can run BitLocker commands. In the absence of elevated privileges, the vulnerability cannot be leveraged.