Windows BitLocker: Security feature bypass via heap-based buffer overflow
Summary
A heap-based buffer overflow in Windows BitLocker allows a bypass of the disk encryption security feature. The attack requires physical access to the device and no credentials, and the CVSS base score is 6.8 (Medium). An attacker with physical access could potentially reach data on an encrypted volume; the exact preconditions are not yet confirmed by the vendor.
Affected
- Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612\n- Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376\n- Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807\n- Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807\n- Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652\n- Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711\n- Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711\n- Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231\n- Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711\n- Windows Server 2012 (incl. Server Core): 6.2.9200.0 to before 6.2.9200.26434\n- Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to before 6.3.9600.23470\n- Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
Fixed in
- Fixed builds are the versions listed as 'to before' above, or later.\n- KB numbers: Unknown. Check the MSRC Security Update Guide for the full fixed-build list.
Workaround
Unknown. No vendor-stated workaround specific to CVE-2026-97015 was found.
Exploitation
- Not known to be exploited as of 10 Nov 2026 (OffSeq aggregator).\n- No public proof of concept found.\n- No CISA KEV entry.\n- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Install the Microsoft security update for your Windows versions through the normal update cycle, starting with mobile laptops and devices that leave the office.\n- Check whether devices on out-of-support versions (1607, 1809, 21H2, 22H2) can receive the fix, for example through Extended Security Updates.\n- Where operationally feasible, enforce TPM plus PIN or equivalent pre-boot authentication and store recovery keys securely.\n- Re-check NVD, CISA KEV and the MSRC advisory, as the CVE was published only recently.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Security feature bypass – Windows BitLocker
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126835, KB5126836, KB5126868, KB5126651, KB5126657, KB5126655
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-97015 (CVE.org) www.cve.org
- MSRC Security Update Guide CVE-2026-97015 msrc.microsoft.com
- OffSeq threat radar CVE-2026-97015 radar.offseq.com
- Strix CVE-2026-97015 (third-party, unverified) www.strix.ai
- Penligent analysis of related BitLocker bypasses www.penligent.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:17.
Original description (NVD)
Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.