A time‑of‑check time‑of‑use (TOCTOU) race condition in the BitLocker component of Microsoft Windows allows an attacker who already has local account access to elevate privileges. The flaw can be triggered when an authorized user performs operations that rely on the BitLocker service to validate a request before the system uses the result, allowing the attacker to gain higher privileges within the local session and potentially take full control of the affected machine. This weakness is categorized as a race condition.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2; Windows 11 version 23H2; Windows 11 version 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (both full and Server Core installations). The flaw impacts the BitLocker encryption feature on all these operating systems.

The CVSS score is 7, indicating a high severity of local privilege escalation. EPSS is not available, so the current exploitation probability is unknown, but the weakness is listed as not in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker to already have authorized access to the system. The vulnerability can be leveraged by exploiting the race condition in BitLocker’s check‑and‑use sequence, potentially allowing a privileged escalation with no additional privileges or external network access needed.