Windows BitLocker EUVD-2026-35589

Physical presence at the target device is the firm prerequisite for exploitation, confirmed by CVSS vector AV:P - remote exploitation is not possible under any configuration. No privileges are required (PR:N) and no user interaction is needed (UI:N), meaning the device does not need to be powered on, logged in, or attended by the owner at the time of attack. The specific BitLocker configuration mode or Windows feature flag that triggers the protection mechanism failure (CWE-306) is not enumerated in the available description; the MSRC advisory should be consulted to determine whether only TPM-only configurations, specific Windows editions, or particular boot modes are susceptible. Exploitation is bounded by: (1) the physical access requirement limiting attackers to those who can physically handle the device, (2) the need to target Windows systems with BitLocker enabled and the affected version installed, and (3) any device-level protections such as Secure Boot or BIOS passwords that may independently raise attacker prerequisites beyond what this CVE alone describes.

The CVSS 6.8 Medium score is appropriate given the physical access requirement (AV:P), which substantially narrows the attacker population to individuals who can physically handle the target device - such as in theft, loss-of-device, or insider threat scenarios. However, the H/H/H impact triad (confidentiality, integrity, availability all High) signals that once the physical threshold is crossed, the exploitation is unconstrained: the attacker gains full data exposure and write access. Attack complexity is low (AC:L) and no privileges or user interaction are required (PR:N, UI:N), meaning physical access alone is sufficient for a technically capable adversary. No EPSS data was provided, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog based on available data, suggesting no confirmed widespread active exploitation at time of analysis. For organizations relying on BitLocker as the primary data-at-rest control for mobile workforces - laptops, tablets, field devices - this represents a meaningful real-world risk despite the medium CVSS score, as device theft is a common event. The absence of POC and KEV listing means this is currently a targeted-exposure risk rather than an opportunistic mass-exploitation threat.

An attacker steals or gains unsupervised physical access to a Windows laptop protected by BitLocker - for example, left unattended in a conference room or seized at a border crossing - and exploits the missing authentication enforcement (CWE-306) to interact directly with the encrypted drive and bypass BitLocker's protection gate without supplying a PIN or recovery key. With the encryption barrier removed, the attacker mounts the volume and accesses plaintext files, credentials, or configuration data, or plants persistent malware in the now-writable system partition. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) in the CVSS vector indicates that exploitation does not require specialized tools or chained vulnerabilities once physical access is established.