Earlier this week Microsoft revealed two new vulnerabilities—CVE-2026-97015 and CVE-2026-119832—in Windows BitLocker that allow attackers with physical access to bypass disk encryption protections. Both are rated “Important,” with CVSS scores of 6.8 and 5.9 respectively. These flaws don’t require active participation from another user, making systems with default protections particularly exposed.
How the attacks work
CVE-2026-119832 is an access-control issue. An attacker with basic user privileges and physical access can bypass BitLocker Device Encryption on the system storage device without needing user interaction or elevated privileges.
CVE-2026-97015 involves a heap-based buffer overflow (CWE-122) in BitLocker. It allows someone with no privileges and no user interaction to trigger a patchable overflow and bypass BitLocker’s protections. As with the first flaw, physical access is required.
Affected platforms & updates
CVE-2026-119832 spans a wide array of Windows versions: Windows 10 builds 1809, 21H2, 22H2; several Windows 11 releases; and Windows Server 2019, 2022, and 2025 platforms.
CVE-2026-97015 affects not just recent Windows versions but older releases as well—including Windows 10 (1607, 1809, 21H2, 22H2), multiple Windows 11 builds, and server editions back through Windows Server 2012 and beyond. Microsoft has published fixes via updates tied to specific KB articles per build.
What defenses help now
Microsoft emphasizes that physical access is a key precondition. That means devices trusted in public or unsecured physical spaces are most at risk. Attackers don’t need to trick users into clicking links or approving prompts.
To mitigate, administrators should apply the patches for both vulnerabilities immediately. Also effective: ensure BitLocker configurations use TPM plus a PIN or other secondary factor rather than TPM-only unlock. Strengthening pre-boot authentication settings reduces exposure. Physical security for devices remains indispensable.
These vulnerabilities add to a growing list of recent BitLocker bypass and privilege escalation flaws patched by Microsoft. Previous updates fixed issues like TOCTOU race-conditions and improper access control failures.
What this means: even well-regarded disk encryption like BitLocker isn’t immune to attacks under certain conditions. Default or simplified setups (e.g. TPM-only) are especially risky in scenarios with physical device exposure. Watch for how Microsoft adjusts advisory severity, and whether attackers begin exploiting these flaws in the wild.
