Windows BitLocker EUVD-2026-99646

Exploitation requires the attacker to already have local, authenticated access to a Windows system as a low-privileged user (PR:L, AV:L) and the ability to execute code locally against the BitLocker component; there is no remote or network-triggerable path. The out-of-bounds read is then abused to leak memory and elevate privileges to SYSTEM. Limiting factors that reduce real-world risk: the attacker must first establish a local foothold with valid credentials, no exploitation has been observed (SSVC Exploitation: none), and the attack is not automatable (SSVC Automatable: no). Affected deployments are those running Windows 10/11 or Windows Server builds below the fixed versions listed in EUVD-2026-99646; applying the vendor patch removes the condition.

Signals are largely consistent and point to a genuine but non-urgent local privilege-escalation risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a low-complexity local attack by an already-authenticated low-privileged user yielding full confidentiality, integrity and availability impact - i.e. elevation to SYSTEM. CISA's SSVC framework corroborates this with Technical Impact: total, but critically rates Exploitation: none and Automatable: no, meaning no observed exploitation and no reliable mass-automation path (consistent with a local-only EoP that needs an existing foothold). There is no CISA KEV listing and no POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. There is no conflict between the network-vs-local signals: both CVSS (AV:L) and the description ('elevate privileges locally') agree this is local. The main caveat is data provenance - the only reference is the Microsoft MSRC update-guide page (NVD enrichment shows None), so EPSS is not provided and cannot be weighed. Net: a real patch-priority item for endpoint/privilege-hardening programs because of the ubiquitous platform and total technical impact, but not a drop-everything emergency given local-only access, authenticated prerequisite, and no evidence of exploitation.

A local attacker who already has a valid low-privileged account on a Windows machine runs a crafted program that triggers an out-of-bounds read (CWE-125) in the BitLocker component, leveraging the leaked memory to escalate to SYSTEM-level privileges. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the attacker must first obtain local code-execution as an authenticated user. No public exploit identified at time of analysis.