Two Windows BitLocker flaws let physical attackers bypass encryption
Original title: Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature
Microsoft says CVE-2026-119832 was not publicly disclosed or known exploited when the November 10 advisories shipped.
Microsoft disclosed two Important BitLocker security-feature bypasses on November 10, 2026. CVE-2026-97015 is a heap-based buffer overflow usable in a physical attack with no privileges. CVE-2026-119832 is an access-control flaw that can expose encrypted system storage and needs physical access plus low privileges.
Unconfirmed: The statement that exploitation was not known applies explicitly to CVE-2026-119832.
- CVSS base scores are 6.8 and 5.9, respectively.
- CVE-2026-119832 affects Windows 10 1809, 21H2 and 22H2, Windows 11, and Server 2019, 2022 and 2025.
- CVE-2026-97015 also covers older Windows Server branches.
- Named updates include KB5131096, KB5131087, KB5132059, KB5131085 and KB5131090.
- Microsoft credits researcher yhw and rates exploitation less likely.
Impact: Physical attacker can bypass BitLocker and read encrypted data.
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows BitLocker | Windows 10 1809, 21H2, 22H2; Windows 11; Windows Server 2019, 2022, 2025; older Server branches for CVE-2026-97015 | KB5131096, KB5131087, KB5132059, KB5131085, KB5131090 |
- 1.Install the BitLocker updates Microsoft lists for each affected Windows release.
- 2.Review both CVE records rather than using one shared device list.
- Vendors
- Microsoft
- Products
- WindowsBitLockerWindows Server
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-97015+1 related CVE | Heap buffer overflow in Windows BitLocker via physical attack | 6.8 group max | — |
From the original article
2 min read at cybersecuritynews.com
Microsoft has disclosed two Windows BitLocker security feature bypass vulnerabilities that could allow attackers with physical access to weaken device protections. Published on November 10, 2026, the flaws are tracked as CVE-2026-97015 and CVE-2026-119832. Microsoft rates both as Important, with CVSS base scores of 6.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.