CVE-2025-55337
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Risk Assessment
An attacker with physical access to the device can bypass BitLocker protection and access encrypted data.
Recommendation
Apply Windows security updates and restrict physical access to devices, enabling additional protections such as a pre-boot PIN.
Other vulnerabilities in Windows BitLocker
See all- CVE-2026-96909Critical
A heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. The vulnerability stems from improper memory handling during data processing.
- CVE-2026-50507Medium
Missing authentication for a critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- CVE-2026-88070High
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- CVE-2026-85920High
Time-of-check time-of-use (TOCTOU) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- CVE-2026-83634High
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
- CVE-2026-83500Medium
URL redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- CVE-2026-69458High
Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69449Medium
A heap-based buffer overflow in Windows BitLocker allows an authorized attacker to execute code locally.
- CVE-2026-50661Medium
A protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- CVE-2026-45658High
Improper access control in Windows BitLocker allows an authorized attacker to bypass a security feature locally.
Original NVD description (English source)
Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS