Windows BitLocker CVE-2026-85920

Requires an already-authenticated, low-privileged local account on a Windows system where BitLocker is in use (AV:L, PR:L), and the attacker must win a time-of-check-to-time-of-use race condition - a non-deterministic window reflected by AC:H and by SSVC Automatable=no, which materially limits reliable exploitation. No user interaction is required (UI:N). Limiting factors: exploitation is purely local (not remotely reachable), needs valid credentials/foothold, and depends on BitLocker being active on the target; the affected builds span Windows 10/11, Windows Server 2012 through 2025, and Server Core installations below the fixed build numbers listed in the EUVD data.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.0 (HIGH) is tempered by its vector: AV:L means the attacker must already have local access, AC:H reflects the inherent difficulty of reliably winning the TOCTOU race window (CWE-367), and PR:L means a valid low-privileged account is required. Impact is severe where exploitation succeeds (C:H/I:H/A:H, consistent with elevation to SYSTEM). The CISA SSVC framework strongly agrees with a non-urgent posture: Exploitation=none, Automatable=no, Technical Impact=total - i.e. high consequence but no observed exploitation and no reliable, scalable weaponization (the 'no' for automatable aligns with the AC:H race condition, which is non-deterministic and hard to automate). No KEV listing, no public exploit, and no EPSS score were provided, so there is no evidence of imminent widespread exploitation. The exploitation status is therefore 'no public exploit identified at time of analysis.' Net: a real local privilege-escalation flaw worth patching in normal cycles, not a drop-everything network-exploitable bug. One data note: the input Tag 'Information Disclosure' conflicts with the description and CVSS, which describe privilege elevation with full triad impact - treat the tag as unreliable and rely on the description/vector.

An attacker who already has a low-privileged authenticated session on a Windows host running BitLocker repeatedly triggers a BitLocker operation while manipulating the underlying resource in the narrow window between the security check and its use (TOCTOU). On a successful race, the attacker elevates to SYSTEM and gains full control of the device. No public proof-of-concept is identified, and the AC:H rating indicates winning the race reliably is non-trivial.