A double free flaw in the Windows BitLocker implementation can be triggered by an authorized user on a vulnerable system. The flaw enables the attacker to raise their privileges locally, granting them elevated access to the operating system without requiring external exploitation.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; Microsoft Windows Server 2022; Microsoft Windows Server 2025, including Server Core installations.

The CVSS score of 7.8 indicates a high severity vulnerability. EPSS information is not available, and the issue is not listed in CISA's KEV catalog, which suggests that public exploitation is limited or not yet observed. The attack vector is local; an attacker must already possess authorized access to the target machine to trigger the double free and thereby elevate privileges.