Windows BitLocker CVE-2025-55682

Requires physical access to a device running BitLocker on Windows 11 24H2, Windows 11 25H2, or Windows Server 2025 (AV:P). The flaw lies in improper enforcement of BitLocker's protective workflow (CWE-841), letting an attacker in physical possession of the machine bypass the disk-encryption security feature to access data at rest. Exploitation is strictly LIMITED by the need for hands-on physical access - it cannot be performed remotely or over a network, which bounds realistic exposure to lost, stolen, unattended, or seized devices (evil-maid style threat models) rather than scalable remote attacks. No authentication or user interaction is required once the device is physically accessible (PR:N/UI:N).

This is a genuinely low-to-moderate priority issue despite the 'security feature bypass' framing. The CVSS 3.1 base score of 4.6 (Medium) is driven almost entirely by the Physical attack vector (AV:P), which is the single most limiting factor: an attacker must have hands-on access to the device. Attack complexity is Low (AC:L) and no privileges or user interaction are required (PR:N/UI:N) once physical access is obtained, and impact is confined to confidentiality (C:H, I:N, A:N) - consistent with defeating BitLocker's at-rest disk encryption to read protected data. The EPSS score of 0.52% (43rd percentile) is low and aligns with the physical-access constraint, since physical attacks do not scale to automated/remote mass exploitation. The CVE is NOT listed in CISA KEV and no public exploit code was provided in the intelligence set, so there is no evidence of active exploitation. All signals are internally consistent (physical vector, low EPSS, no KEV, no POC), so there is no conflict to flag - the risk is real but situational, relevant primarily to threat models involving lost/stolen/seized devices or evil-maid attacks rather than remote network threats.

An attacker who gains physical possession of a laptop or server running an affected Windows build (e.g., a lost, stolen, or temporarily unattended device) exploits improper enforcement of BitLocker's protection workflow to bypass the encryption security feature and access data on the drive. Because the CVSS vector is AV:P/AC:L/PR:N/UI:N, no credentials or user interaction are needed once the device is in hand, though the attack does not scale beyond devices the attacker can physically touch. No public proof-of-concept was identified in the provided data.