Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature

Two newly disclosed BitLocker vulnerabilities expose a critical gap: encryption at rest provides little protection when the underlying platform software can be bypassed. CVE-2026-119832 is particularly alarming because it requires only physical access and basic user privileges to defeat BitLocker Device Encryption — a scenario common in lost or stolen laptops. CVE-2026-97015 compounds the risk with a heap-based buffer overflow that requires no privileges or user interaction, widening the attack surface. These flaws matter because organisations often treat BitLocker as a final safety net for endpoint data protection, yet that net fails completely if patches are not applied promptly. Microsoft has released KB updates, making timely patch deployment the single most effective control available right now.