Windows BitLocker CVE-2026-45655

Physical presence at the target device is strictly required, as the CVSS attack vector AV:P (Physical) confirms this is not remotely exploitable under any network condition. The attacker requires no prior authentication (PR:N) and no user interaction (UI:N), meaning the device does not need to be powered on, logged in, or unlocked by the legitimate user at time of attack. The specific hardware interaction technique required to trigger the protection mechanism failure is not disclosed in available public data - the precise method (TPM communication interception, pre-boot environment manipulation, or other physical vector) remains unconfirmed from this intelligence. What limits exploitation: the absolute requirement for physical device access eliminates all remote and network-adjacent attack scenarios; server hardware in locked data centers with monitored physical access has substantially reduced realistic exposure. What does NOT limit exploitation: no authentication, no special software configuration, and no specific OS state appears required based on the PR:N/UI:N/AC:L vector components.

The CVSS base score of 5.3 (Medium) is shaped primarily by the physical attack vector (AV:P), which substantially limits the realistic attacker pool to adversaries with direct hands-on access to the device. The Changed Scope elevation partially offsets this mitigating factor by acknowledging the serious cross-boundary confidentiality impact. No EPSS data was provided in the available intelligence, and this CVE is not listed in CISA KEV, confirming no verified active exploitation at time of analysis. No public POC has been identified. Despite the medium CVSS score, real-world risk to organizations deploying BitLocker specifically for its intended use case - protecting lost, stolen, or physically accessible devices - is meaningfully higher: the entire threat model that BitLocker defends against centers on physical access scenarios. Enterprises with laptops in the field, shared workstations, or hardware deployed in uncontrolled environments (branch offices, retail, healthcare kiosks) face elevated practical risk and should prioritize patching accordingly. Servers in locked data centers have substantially lower exposure.

A threat actor with physical access to an unattended Windows laptop - obtained via theft, loss, or an evil maid attack in an unsupervised location such as a hotel room or open office - exploits the BitLocker protection mechanism failure to read the contents of the encrypted volume without knowledge of the BitLocker PIN, recovery key, or user credentials. Leveraging the low attack complexity (AC:L) and no-privileges-required (PR:N) conditions, the attacker interfaces directly with the device hardware, circumventing the encryption boundary and accessing sensitive organizational data, personal files, or credentials stored on disk. No public exploit code has been identified at time of analysis, and the specific physical technique (e.g., TPM bus sniffing, DMA attack, cold boot) has not been confirmed from available intelligence.