{"id":"CVE-2026-97015","kind":"vulnerability","aliases":["CVE-2026-97015"],"related":[],"title":"Windows BitLocker: heap overflow lets physical attacker bypass disk encryption","description":"Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.","summary":"A heap-based buffer overflow in Windows BitLocker lets an unauthorized attacker bypass a BitLocker security feature. The attack requires physical access to the machine.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bitlocker","endpoints","infrastructure","windows"],"not_affected_if":["bitlocker-disabled","no-physical-access"],"how_to_check":"- Check whether BitLocker is enabled on Windows devices with `manage-bde -status` in an elevated prompt.\n- Check the installed Windows build with `winver` and compare it to the patch date in the Microsoft advisory, which the sources do not give.","fix":null,"status":"open","published_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","triaged_at":"2026-11-10T19:54:23+00:00","updated_at":"2026-11-10T19:54:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:54:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows BitLocker: heap overflow lets physical attacker bypass disk encryption","impact":"medium","summary":"A heap-based buffer overflow in Windows BitLocker lets an unauthorized attacker bypass a BitLocker security feature. The attack requires physical access to the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","bitlocker","endpoints"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"physical attacker bypasses BitLocker protection on a device","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-97015 to confirm affected Windows builds and the patch.","how_to_check":"- Check whether BitLocker is enabled on Windows devices with `manage-bde -status` in an elevated prompt.\n- Check the installed Windows build with `winver` and compare it to the patch date in the Microsoft advisory, which the sources do not give.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-physical-access","bitlocker-disabled"],"who_is_affected":"Windows machines with BitLocker drive encryption enabled are the subject of this flaw. The attacker needs physical access to the device, so systems in locked offices or with strong boot protections face lower risk. The sources do not name the affected Windows builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4504,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97015':13A,16A 'access':43B 'allow':55C 'attack':7A,33B,40B,58C,67C 'base':24B,49C 'bitlock':2A,17B,29B,36B,54C 'buffer':25B,50C 'bypass':8A,34B,60C 'cve':11A,14A 'disk':9A 'encrypt':10A 'endpoint':18B 'featur':38B,63C 'heap':3A,23B,48C 'heap-bas':22B,47C 'infrastructur':19B 'let':5A,30B 'machin':46B 'overflow':4A,26B,51C 'physic':6A,42B,66C 'requir':41B 'secur':37B,62C 'unauthor':32B,57C 'window':1A,20B,28B,53C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with BitLocker drive encryption enabled are the subject of this flaw. The attacker needs physical access to the device, so systems in locked offices or with strong boot protections face lower risk. The sources do not name the affected Windows builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bitlocker","endpoints","infrastructure","medium","windows"],"campaign_type":null,"search_a":"'-2026':12A,15A '-97015':13A,16A 'attack':7A 'bitlock':2A 'bypass':8A 'cve':11A,14A 'disk':9A 'encrypt':10A 'heap':3A 'let':5A 'overflow':4A 'physic':6A 'window':1A","search_b":"'access':43B 'attack':33B,40B 'base':24B 'bitlock':17B,29B,36B 'buffer':25B 'bypass':34B 'endpoint':18B 'featur':38B 'heap':23B 'heap-bas':22B 'infrastructur':19B 'let':30B 'machin':46B 'overflow':26B 'physic':42B 'requir':41B 'secur':37B 'unauthor':32B 'window':20B,28B","search_c":"'allow':55C 'attack':58C,67C 'base':49C 'bitlock':54C 'buffer':50C 'bypass':60C 'featur':63C 'heap':48C 'heap-bas':47C 'overflow':51C 'physic':66C 'secur':62C 'unauthor':57C 'window':53C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97015","severity":null,"published_at":"2026-11-10T19:22:23+00:00","modified_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","fetched_at":"2026-11-10T19:25:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}