Microsoft Windows 11 BitLocker: Elevation of privilege via double free
Summary
A double free (CWE-415) in the Windows BitLocker component allows a locally authenticated user with low privileges to elevate their privileges to a higher level on the affected system. Successful exploitation can lead to a complete compromise of confidentiality, integrity and availability of the device. Exploitation requires a valid local account and a foothold on the machine; it is not remotely exploitable.
Affected
- Windows 11 Version 23H2 (x64 and ARM64): builds below 10.0.22631.7652
- Windows 11 Version 24H2: builds below 10.0.26100.9711
- Windows 11 Version 25H2: builds below 10.0.26200.9711
- Windows 11 Version 26H1: builds below 10.0.28000.3231
- Windows 11 Version 26H2: builds below 10.0.26300.9711 (third-party source, not confirmed by vendor)
- Windows Server 2022: builds below 10.0.20348.5761 (third-party source, not confirmed by vendor)
- Windows Server 2025 (including Server Core): builds below 10.0.26100.33650 (third-party source, not confirmed by vendor)
Fixed in
Unknown. The October 2026 updates are expected to contain the fix; third-party sources cite KB5126653 (23H2) and KB5126646 (Server 2025), which are unverified. Verify on the MSRC advisory before deployment.
Workaround
Unknown. No workaround is documented in the sources reviewed. Installing the security update is the practical remedy.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total
- Not listed in CISA KEV at the time of research
- EPSS below 1%
- No public proof of concept found in the limited search performed
Our recommendation
- Inventory all Windows 11 and Windows Server systems, not only 23H2, and check their build numbers
- Install the October 2026 security updates on affected systems after verifying the KB numbers on the MSRC page
- Prioritise shared PCs, laptops with BitLocker and hosts with many local users
- Limit local interactive logons on shared machines
- Plan the upgrade from 23H2 to 24H2 or 25H2, as 23H2 servicing may end soon (verify Microsoft's lifecycle page)
- Raise the priority if exploitation is reported or the flaw appears in CISA KEV
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-83634 msrc.microsoft.com
- OpenCVE: CVE-2026-83634 app.opencve.io
- Vulners NVD: CVE-2026-83634 vulners.com
- Vulners CVElist: CVE-2026-83634 vulners.com
- Strix AI: CVE-2026-83634 (third-party) www.strix.ai
- Tenable Nessus plugin 365473 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:33.
Original description (NVD)
Double free in Windows BitLocker allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.