Windows BitLocker EUVD-2026-35572

Exploitation requires physical access to a Windows device with BitLocker Drive Encryption enabled, consistent with the CVSS AV:L vector and the description's explicit 'physical attack' wording; remote exploitation is not in scope. The PR:L component indicates the attacker also needs some low-level privilege or local context (e.g., an existing local user session, ability to boot the device, or hardware-level interaction such as connecting to an exposed bus/port), so a fully powered-off device protected with TPM+PIN pre-boot authentication and disabled DMA ports materially limits exploitability. UI:N means no user interaction is required once physical access is obtained, making unattended, stolen, or lost devices the realistic target population rather than devices in continuously supervised environments.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) describes a local attack with low complexity requiring low privileges and no user interaction, with high CIA impact - consistent with the description's 'physical attack' framing, where the attacker has hands-on access to the device. EPSS data is not provided, and the vulnerability is not on the CISA KEV list at time of analysis, so there is no public exploit identified at time of analysis. Real-world risk is concentrated on portable, easily-stolen, or unattended endpoints (laptops, kiosks, field devices) and on threat models where physical possession is realistic - corporate fleet theft, evil-maid attacks, lost devices, and supply-chain or border-inspection scenarios. For purely datacenter or physically-controlled assets, residual risk is meaningfully lower; the CVSS score therefore overstates risk for some deployments and understates it for high-mobility fleets.

An attacker who obtains physical possession of a powered-off or locked Windows laptop - for example through theft, an evil-maid scenario, or temporary unattended access during travel - manipulates the boot environment or hardware interfaces to bypass BitLocker's protection mechanism and read or modify the supposedly encrypted volume. Because the CVSS vector is AV:L with low complexity and the description explicitly notes a physical attack, the scenario is realistic for any unattended Windows endpoint with BitLocker as the sole at-rest protection. No public proof-of-concept has been identified at time of analysis.