A newly disclosed security feature bypass in Windows BitLocker encryption, tracked as CVE-2026-50661, allows attackers with physical access to a device to decrypt the system drive and access protected data, undermining the primary defense for stolen laptops and storage media.
The vulnerability exploits a gap in how BitLocker handles the pre-boot authentication phase. By interrupting the boot process at a specific point, attackers can force the Trusted Platform Module to release the full volume encryption key without requiring the correct PIN or recovery key. Microsoft has acknowledged the flaw and is working on a patch, but no timeline has been provided for a fix.
The zero-day affects all supported Windows versions with BitLocker enabled, including Windows 10 and 11 enterprise deployments. Organizations relying on BitLocker for data-at-rest protection are advised to supplement it with additional controls such as Microsoft BitLocker Administration and Monitoring and physical security measures. The vulnerability was responsibly disclosed to Microsoft through the coordinated vulnerability disclosure program.
HTMLEOF
