Windows BitLocker EUVD-2026-44122

Physical access (AV:P) to the target device is the sole hard prerequisite - the attacker must be able to interact directly with the machine. No authentication or existing account privileges are required (PR:N). BitLocker must be enabled on the target volume; devices without BitLocker configured are outside this vulnerability's scope. The most common limiting deployment factor is TPM-only BitLocker without a pre-boot PIN: this configuration does not prompt users for a passphrase at boot, making it the most exploitable posture. Environments using BitLocker with a pre-boot PIN or passphrase add an out-of-band secret that may or may not be circumvented by this specific bypass - this is not clarified in available data. The SSVC determination of Automatable: No confirms that exploitation cannot be scripted at scale across a network, strictly bounding the threat to actors with hands-on physical access.

Real-world risk is substantially constrained by the physical access requirement (AV:P), which eliminates remote or network-based exploitation entirely. EPSS at 0.38% (30th percentile) reflects low observed exploitation probability, and CISA has not added this to KEV. SSVC rates exploitation as none and automatable as no, reinforcing that bulk exploitation is not feasible. However, SSVC Technical Impact is listed as total - likely because a successful bypass exposes the full plaintext contents of a protected drive, which aligns with CVSS C:H. The tension is that while the technical impact on the device is severe (complete confidentiality loss of encrypted data), the attack preconditions (physical possession of the device) limit the realistic threat actor population to insiders, border/customs scenarios, device theft, or nation-state adversaries with physical access capabilities. A publicly available POC on GitHub (referenced in CVE data) meaningfully reduces attacker skill requirements for those who do have physical access. CVSS score of 4.6 (Medium) appropriately reflects this - high consequence but high barrier to exploitation. Priority should be elevated for organizations with high-value laptops in travel or shared-access scenarios.

An attacker steals or temporarily accesses a laptop belonging to a corporate employee - for example, during travel or in an unattended office - and uses the publicly available proof-of-concept (https://gist.github.com/alon710/241fe7f4e9eb231b7e18efd4dc0b5fdd) to bypass BitLocker protections and mount the encrypted drive in a readable state, extracting credentials, intellectual property, or sensitive documents without triggering any authentication prompt or leaving software-visible forensic artifacts. Because the attack requires no authentication (PR:N) and low complexity (AC:L) once physical access is secured, a moderately skilled adversary can complete the exfiltration in minutes using readily available tooling.