This vulnerability arises from an open redirect flaw in the Windows BitLocker interface, allowing an attacker to manipulate URLs that BitLocker processes. The flaw permits a physical attacker to divert BitLocker's authentication flow to a malicious site, effectively bypassing the encryption protection and accessing data stored on a protected volume. The weakness, identified as CWE‑601, means that authenticated users can redirect the system to external destinations without proper validation, eroding the confidentiality guarantees of the encryption feature.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; Microsoft Windows Server 2016, 2019, 2022, 2025 (including Server Core installations). These systems may be exposed to the vulnerability if not patched.

The CVSS score is 6.1, characterizing a moderate severity. An EPSS score of <1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a physical attack where the attacker can interact with the target device, introduce a malicious redirect, and trigger BitLocker to accept the payload. The exploitation requires local access but no need for remote network interaction, making it a high‑impact scenario for facilities that do not secure physical access to encrypted systems.