Windows BitLocker EUVD-2026-99294

Requires physical possession of and local access to a BitLocker-protected Windows device (AV:P); the flaw lets an open redirect to an untrusted site be abused to bypass the drive-encryption security feature. LIMITING FACTORS: the attack cannot be performed remotely or over a network, cannot be automated (SSVC Automatable: no), and realistically targets unattended, lost, or stolen hardware or evil-maid situations; it does not threaten devices kept under physical control, and patched builds (per the EUVD fixed-version ranges) remediate it. No remote or authenticated-network exploitation path exists.

Signals converge on LOW operational priority despite a CVSS 6.1 (medium) base score. The CVSS vector AV:P/AC:L/PR:N/UI:N is the dominant limiter: exploitation requires PHYSICAL access to the target device, which CISA's SSVC framework corroborates (Exploitation: none, Automatable: no, Technical Impact: partial). No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One internal tension worth flagging: the vulnerability is classed as CWE-601 (open redirect), yet the declared impact is C:H/I:H - unusually high for a classic URL-redirect weakness; here the 'redirect' is being leveraged as a BitLocker security-feature bypass that ultimately exposes protected data, which explains the high confidentiality/integrity rating but should be verified against the Microsoft MSRC advisory. Net: this is a real-but-low-urgency patch-management item - meaningful for high-value endpoints exposed to physical tampering (lost/stolen laptops, kiosk, evil-maid scenarios) but not an internet-facing mass-exploitation threat.

An attacker with hands-on physical possession of a BitLocker-protected device (e.g., a stolen or unattended laptop) abuses the open-redirect flaw in the BitLocker flow to bypass the security feature and reach protected data. No public exploit code is known, and the attack cannot be performed remotely or automated, so it is confined to targeted evil-maid-style physical access.