Windows BitLocker CVE-2026-96909

Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication or user-interaction prerequisites, implying remote unauthenticated exploitation of affected Windows builds (Windows 11 23H2-26H2, Windows Server 2022/2025 below the patched build numbers listed in EUVD). The practical limiting factor is reachability of the vulnerable BitLocker code path: BitLocker is a full-disk-encryption feature typically exercised locally or during pre-boot/recovery, so network exploitation likely requires the host to expose that specific path (e.g., a network-facing pre-boot, recovery, or management scenario) rather than any default service - this should be confirmed against the MSRC advisory, as it materially narrows exposure versus a generic internet-facing service.

Multiple signals point to high priority but with one notable internal tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) describes remote, unauthenticated, low-complexity exploitation with total CIA impact, and the CWE-122 heap overflow with a 'total' SSVC technical impact reinforces a full-system-compromise outcome. SSVC also marks the flaw Automatable:yes, meaning it could be reliably scripted/wormed if a working exploit emerges. Counterbalancing this, SSVC Exploitation is 'none', there is no CISA KEV listing and no public POC, so no public exploit identified at time of analysis - real-world pressure is currently theoretical despite the critical score. The key conflict to flag: the affected component is Windows BitLocker, a full-disk-encryption feature normally reached locally or at pre-boot, yet the description and CVSS assert code execution 'over a network' (AV:N). This network reachability for an encryption component is atypical and should be verified against Microsoft's MSRC advisory before assuming broad remote exposure; it may depend on a specific recovery/pre-boot or management path rather than the general network. Net: treat as critical for patching given ubiquitous Windows footprint and total impact, but current exploitation likelihood is lower than the 9.8 alone implies.

An unauthenticated attacker with network reachability to a vulnerable BitLocker code path sends a crafted request that overflows a heap buffer (CWE-122), corrupting memory to achieve arbitrary code execution on the target Windows host. Because CVSS rates attack complexity low and no privileges or user interaction are required, a reliable exploit would need no victim action - though no public POC or active exploitation is known at time of analysis.