Windows BitLocker EUVD-2026-72973

Exploitation requires a low-privileged authenticated account on the network (CVSS PR:L, AV:N) - anonymous unauthenticated access is not sufficient. Additionally, user interaction is required (UI:R), meaning the attacker must induce a legitimate user to take some action that triggers the vulnerable BitLocker code path; fully automated exploitation without user involvement is not possible given the provided CVSS vector. The specific nature of the required user interaction is not detailed in available advisories. Exploitation is limited to Windows systems where BitLocker is enabled and network-accessible; systems with BitLocker disabled or not network-reachable by low-privileged accounts are not exposed to the network attack vector.

The CVSS 8.0 score with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a meaningful but constrained threat: exploitation requires a low-privileged authenticated account and user interaction (UI:R), which prevents fully automated mass exploitation. The AC:L component means no special race conditions or configuration quirks are needed beyond those authentication prerequisites. The full C:H/I:H/A:H triad implies that once the privilege escalation succeeds, the attacker attains a level of access with comprehensive system impact - consistent with elevation to SYSTEM or equivalent on Windows. The absence of a CISA KEV entry and no public POC code at time of analysis keeps practical exploitation risk moderate despite the high theoretical impact; even a mid-sized municipal IT team in boleslawiec should treat this as urgent given how broadly BitLocker is deployed across managed Windows fleets. The UI:R requirement is the primary exploitation barrier and distinguishes this from fully wormable network vulnerabilities. No EPSS data was provided in the input, so probabilistic exploitation frequency cannot be quantified.

An attacker with a low-privileged domain or local account accesses an affected Windows system over the network and crafts a request or interaction targeting the BitLocker component that triggers the out-of-bounds read. By inducing a legitimate user to perform a specific interaction (satisfying the UI:R requirement), the attacker causes the vulnerable code path to execute, reading beyond buffer bounds and providing the data or execution primitive needed to escalate privileges to SYSTEM or an equivalent high-integrity level. No public exploit code has been identified at time of analysis, so exploitation would currently require independent vulnerability research to implement.