Windows BitLocker Vulnerabilities Enable Physical Security Bypass
Microsoft has disclosed two critical vulnerabilities in Windows BitLocker that allow attackers with physical access to bypass encryption and access sensitive data.
Microsoft has alerted users to two significant vulnerabilities affecting its BitLocker drive encryption feature, potentially allowing attackers with physical access to bypass security measures and access encrypted data. The vulnerabilities, tracked as CVE-2026-97015 and CVE-2026-119832, were disclosed on November 10, 2026, and are rated by Microsoft as 'Important' with CVSS base scores of 6.8 and 5.9, respectively. Security teams are advised to address these flaws independently due to their distinct mechanisms and access requirements.
CVE-2026-119832, an access control vulnerability, requires an attacker to have physical access to the device and possess basic user privileges. Despite these requirements, exploitation does not necessitate user interaction, such as clicking a link or opening a file. A successful exploit allows an attacker to bypass BitLocker Device Encryption on the system's storage drive and gain access to the encrypted data. This flaw affects a range of Windows 10, 11, and Server versions, including Windows 10 versions 1809, 21H2, and 22H2, various Windows 11 releases, and Windows Server 2019, 2022, and 2025.
The second vulnerability, CVE-2026-97015, is a heap-based buffer overflow (CWE-122). This type of vulnerability occurs when software writes data beyond the allocated memory buffer, potentially leading to code execution or system instability. Microsoft states that an unauthorized attacker can exploit this flaw through a physical attack to bypass a security feature. Notably, this vulnerability requires no existing privileges and no user interaction, with a low attack complexity. The affected product list for CVE-2026-97015 is broader, encompassing older Windows Server branches in addition to the versions affected by CVE-2026-119832.
Microsoft has provided specific Knowledge Base (KB) updates to address these vulnerabilities. For CVE-2026-119832, affected Windows 10 systems (21H2 and 22H2) can be patched with KB5131096, while Windows 11 23H2 users should apply KB5131087, and Windows 11 26H1 users need KB5132059. Server updates include KB5131085 for Windows Server 2019 and KB5131090 for Windows Server 2022. Administrators are urged to consult Microsoft's official advisories for the precise KB numbers applicable to their specific operating system versions and architectures.
While Microsoft indicated that these vulnerabilities were not publicly disclosed or known to be exploited at the time of their release, the nature of physical access bypasses warrants immediate attention. The researcher credited for CVE-2026-119832 is yhw, who also noted that exploitation is considered less likely. These disclosures follow a pattern of BitLocker bypass vulnerabilities that have emerged previously, underscoring the ongoing challenges in maintaining robust encryption security, especially against determined adversaries with physical access.
These findings highlight the critical importance of physical security alongside software patching. Even with strong encryption like BitLocker, vulnerabilities can emerge that undermine data protection if physical access controls are weak. Organizations should review their physical security policies and ensure that devices are adequately protected against unauthorized physical access, especially for sensitive data.
The disclosure of these BitLocker vulnerabilities serves as a reminder that no security solution is entirely foolproof. Continuous vigilance, prompt patching, and a layered security approach—combining software updates with robust physical security measures—are essential to protect against evolving threats.