Windows BitLocker Flaws Allow Attackers to Bypass Encryption Protection

Two newly disclosed vulnerabilities in Microsoft’s BitLocker drive encryption could allow attackers to bypass encryption safeguards on Windows systems, tracked as CVE-2025-55333 and CVE-2025-55338. The flaws involve incomplete comparison logic and configuration weaknesses that may let a local, low-privileged user undermine BitLocker’s protection, with a CVSS v3.1 base score of 6.1 for network-adjacent attacks and 5.3 for local attacks.

By exploiting missing factor checks, an attacker who already has limited code execution on the device could trick BitLocker into treating an unauthorised request as legitimate, thereby decrypting volumes or exposing encryption keys without needing proper credentials, according to Microsoft. Microsoft assigned both flaws to its internal CNA and released patches on October 14, 2025; admins are urged to apply the October cumulative security update immediately.

The patch corrects the comparison logic by enforcing complete factor validation and updating BitLocker’s command-handling routines to reject malformed requests, and organisations should limit local account creation and monitor for unusual BitLocker command executions until updates are applied. Ensure all Windows installations with BitLocker enabled are updated with the October patch.