Windows BitLocker CVE-2025-55337

Exploitation requires hands-on PHYSICAL access to the target device (CVSS AV:P) running a BitLocker-protected volume on Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 - i.e., an unattended, lost, stolen, or seized machine (evil-maid / border-inspection style scenarios). No credentials, privileges, or user interaction are needed once the device is in the attacker's possession (PR:N/UI:N/AC:L). The decisive LIMITING factor is that the attack cannot be performed over any network and does not scale; it is bounded to one device at a time and defeated by denying physical custody. Impact is limited to confidentiality (reading protected data); it does not grant data modification or denial of service (I:N/A:N).

This is a genuine-but-contained risk rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6 Medium) is the dominant signal: exploitation requires PHYSICAL access to the device, which is the single largest limiting factor and the reason the score lands only at Medium despite a High confidentiality impact. No privileges and no user interaction are required once physical access is obtained, and attack complexity is Low. Supporting signals align with low urgency: EPSS is 0.52% (43rd percentile), indicating low modeled probability of widespread exploitation - consistent with a physical-access bug that does not scale remotely. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided in the input. The signals are mutually consistent (physical vector + low EPSS + no KEV + no POC all point the same direction), so there is no contradiction to flag; the main caveat is that physical-access cryptographic bypasses are high-value for targeted scenarios (lost/stolen/seized laptops, evil-maid attacks) even though they rank low on probabilistic exploitation metrics. This should be patched on a normal-to-prioritized cadence for high-value or travel/field devices, but it is not an emergency internet-facing exposure.

An attacker with hands-on physical possession of a powered-off or unattended Windows 11/Server 2025 device manipulates the BitLocker boot/workflow sequence to bypass the encryption security feature and gain access to protected data on the volume. Because no privileges or user interaction are needed (PR:N/UI:N) and complexity is Low, the attack succeeds quickly once the device is in hand, though it cannot be performed remotely. No public proof-of-concept was identified at time of analysis.