Windows BitLocker EUVD-2026-99927

Exploitation requires the attacker to already have local, authenticated code-execution ability on the host (CVSS PR:L) and to be able to interact with the Windows BitLocker component that contains the double free; no user interaction is needed (UI:N). The vulnerable surface is BitLocker, which is present by default on supported Windows 11 (23H2/24H2/25H2/26H1/26H2) and Windows Server 2022/2025 builds below the patched versions, so no unusual feature toggle is implied by the data. Limiting factors that reduce real-world risk: there is no remote or unauthenticated path (AV:L), the flaw is not automatable per CISA SSVC, so it is not mass-exploitable, and winning the double-free race to achieve reliable SYSTEM execution requires memory-grooming skill rather than a trivial trigger.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege escalation requiring the attacker to already hold some authorization (PR:L) on the target host, with low attack complexity and no user interaction. Multiple signals converge on 'real but gated' risk: CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation), Automatable as 'no' (consistent with a local, non-wormable EoP that cannot be mass-exploited over a network), and Technical Impact as 'total' (matching the C:H/I:H/A:H, i.e. full SYSTEM-level compromise if triggered). EPSS is not provided in the input and this CVE is not in CISA KEV, so there is no quantitative exploitation probability and no confirmed active exploitation. Because this is a local EoP rather than a remote vector, it is almost always a second-stage tool used after an attacker already has a foothold, which lowers urgency relative to a network-facing RCE but still matters for lateral movement, defense evasion, and full host takeover. Note a tag inconsistency: the input Tags include 'Information Disclosure', but the description, CWE-415 (double free), and the 'elevate privileges locally' wording all indicate this is an elevation-of-privilege / memory-corruption issue, not an information-disclosure flaw - treat the 'Information Disclosure' label as suspect.

An attacker who has already obtained low-privileged code execution on a Windows host (for example via phishing, a compromised user account, or an earlier exploit) runs a crafted program that interacts with the vulnerable BitLocker component to trigger the double free (CWE-415). By grooming the freed memory and reusing the dangling allocation, they corrupt kernel or privileged-process state to execute code at SYSTEM level. No public exploit or active exploitation is identified at time of analysis, and the local-only vector (AV:L) means no remote or unauthenticated path exists.