An out‑of‑bounds read flaw exists in the Windows BitLocker encryption engine. An attacker who already has legitimate local access can trigger this defect to read memory beyond the bounds of a buffer, enabling that attacker to gain elevated privileges on the system. The vulnerability operates as a local privilege escalation and does not provide remote attack potential; it requires the attacker to be authenticated and to have already run code on the target machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012 and Server Core, Server 2012 R2 and Server Core, Windows Server 2016, 2019, 2022, and 2025.

The Common Vulnerability Scoring System assigns this flaw a score of 7.8, indicating high severity for a local privilege escalation. No EPSS data is available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because the flaw requires an attacker who is already authenticated and can run code locally, the attack vector is limited to local contexts, but the impact of privilege escalation can be significant once the attacker gains administrative rights.