Windows BitLocker Flaw Allows Privilege Escalation by Attackers

Microsoft has warned about two serious Windows BitLocker flaws that could let attackers escalate privileges on affected machines, tracked as CVE-2025-54911 and CVE-2025-54912, publicly disclosed on 9 September 2025. Both are described as use-after-free weaknesses with an Important severity, and they require local access with some user interaction for exploitation.

CVE-2025-54911 involves a use-after-free error that occurs when BitLocker handles certain memory objects, potentially allowing code execution in a higher security context with a base CVSS score of 7.3 and a temporal score of 6.4, while CVE-2025-54912 is similar but can be exploited without any user interface prompts, carrying a base score of 7.8 and a temporal score of 6.8.

According to Microsoft, security updates have been released for supported Windows versions, including Windows 10 and Windows 11, to correct the memory management errors and prevent use-after-free conditions. Administrators are urged to apply patches promptly via Windows Update or enterprise tools, and those unable to update immediately are advised to restrict local user privileges or disable BitLocker as a temporary measure, though the latter is not recommended long term.

Users are also encouraged to monitor logs for unusual BitLocker service activity and consider additional endpoint protections in high-security environments to detect privilege escalation attempts.