Acceptance of extraneous untrusted data with trusted data in Windows BitLocker

CVE-2025-48804 is a Windows BitLocker security-feature bypass in the WinRE/boot trust chain: trusted recovery and boot artifacts can be mixed with attacker-controlled data so BitLocker auto-unlocks a volume for the wrong environment. NVD maps affected builds across Windows 10, Windows 11, and Windows Server releases prior to the July 8, 2025 fixes, including Windows 11 22H2 < 22621.5624, 23H2 < 22631.5624, 24H2 < 26100.4652, Windows 10 22H2 < 19045.6093, Server 2022 < 20348.3932, and Server 2025 < 26100.4652.

Microsoft's original MEDIUM 6.8 is broadly fair. The later Microsoft STORM research and the public BitUnlocker PoC prove the bypass is not theoretical, which pushes urgency up for mobile fleets using default TPM-only BitLocker; but the exploit still requires physical access, usually USB/PXE boot control, and often a still-trusted PCA 2011 boot path, so this is not a mass remote compromise event.

Why this verdict

• Baseline stays near vendor because BitLocker is widely deployed and compromise means real data exposure when the prerequisites line up.
• Downward adjustment: physical attacker required. This is not unauthenticated remote, authenticated remote, or wormable; it assumes hands-on access to each host, which radically caps scale.
• Downward adjustment: exploit path narrows on modern hardening. BitUnlocker itself calls out non-exploitable cases such as TPM+PIN, CA 2023 migration/KB5025885, DBX revocation, or non-default PCR policy.
• Upward adjustment: practical PoC exists. Microsoft STORM's research and the public GitHub PoC remove the 'theoretical only' argument, especially for fleets that left BitLocker at default TPM-only settings.
• Downward adjustment: blast radius is usually one endpoint. The impact can be severe on that laptop, but it does not inherently hand an attacker domain-wide execution or mass lateral movement.

Why not higher?

A higher rating would fit a remotely reachable or broadly automatable exploit path. This one is still constrained by physical possession, alternate-boot opportunity, and configuration specifics, so the attack population is much smaller than the raw impact numbers suggest.

Why not lower?

This is not ignorable backlog noise because the bypass is now publicly demonstrated and targets a control many defenders rely on for lost-device protection. In mobile, TPM-only fleets, a stolen laptop can become a plaintext data source in minutes if the Secure Boot downgrade protections were never fully finished.

1. Require TPM+PIN on high-risk endpoint classes — Use GPO/Intune to require pre-boot authentication on executives, developers, admins, and all frequently traveling laptops. This directly blocks the mainstream transparent-unlock attack path; for a MEDIUM verdict there is no noisgate mitigation SLA, so treat this as hardening work to complete inside the remediation window, sooner for mobile or high-value users.
2. Finish CA 2023 / REVISE migration — Apply Microsoft's Secure Boot revocation guidance from KB5025885, update recovery media, and verify the estate no longer trusts the downgrade path centered on PCA 2011. This matters because the public PoC explicitly depends on older trusted boot components; again, no noisgate mitigation SLA applies here, but do not leave it as indefinite technical debt.
3. Disable external boot where operations allow — Lock down USB/PXE boot in firmware and protect firmware settings with an admin password on managed laptops and workstations. This does not fix the vulnerability, but it raises attacker effort and removes the easiest PoC delivery methods during the remediation window.
4. Audit BitLocker protector posture — Inventory which devices are TPM-only versus TPM+PIN or startup-key protected, and separate traveling endpoints from fixed-location systems. Your risk is not uniform across 10,000 hosts; the exposed slice is the mobile TPM-only population.
5. Protect recovery keys and reusable secrets — Assume a successfully bypassed laptop exposes cached credentials, browser tokens, local secrets, and unprotected files. Tighten local admin credential hygiene, browser secret storage policy, and privileged account use on endpoints during the remediation window.

Run this on the target Windows host from an elevated PowerShell session: powershell.exe -ExecutionPolicy Bypass -File .\Test-CVE-2025-48804.ps1. It needs local administrator rights to query BitLocker status cleanly; it checks the installed Windows build against the July 2025 fixed build matrix and prints VULNERABLE, PATCHED, or UNKNOWN with context.

# Test-CVE-2025-48804.ps1

# Checks whether the local Windows build is below the known fixed build for CVE-2025-48804.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-BuildString {
    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $build = [int]$cv.CurrentBuildNumber
    $ubr = [int]$cv.UBR
    return [pscustomobject]@{
        ProductName = $cv.ProductName
        DisplayVersion = $cv.DisplayVersion
        CurrentBuild = $build
        UBR = $ubr
        FullBuild = "$build.$ubr"
    }
}

function Get-BitLockerSummary {
    try {
        $osVol = Get-BitLockerVolume -MountPoint $env:SystemDrive
        $protectorTypes = @($osVol.KeyProtector | ForEach-Object { $_.KeyProtectorType }) -join ', '
        return [pscustomobject]@{
            ProtectionStatus = $osVol.ProtectionStatus
            EncryptionMethod = $osVol.EncryptionMethod
            KeyProtectors = if ($protectorTypes) { $protectorTypes } else { 'None/Unknown' }
        }
    }
    catch {
        return [pscustomobject]@{
            ProtectionStatus = 'Unknown'
            EncryptionMethod = 'Unknown'
            KeyProtectors = 'Unknown'
        }
    }
}

# Fixed thresholds from NVD/MSRC July 2025 patch line

$thresholds = @{
    10240 = 21073   # Windows 10 1507

    14393 = 8246    # Windows 10/Server 2016 / 1607

    17763 = 7558    # Windows 10 1809 / Server 2019

    19044 = 6093    # Windows 10 21H2

    19045 = 6093    # Windows 10 22H2

    20348 = 3932    # Server 2022

    22621 = 5624    # Windows 11 22H2

    22631 = 5624    # Windows 11 23H2

    25398 = 1732    # Server 2022 23H2

    26100 = 4652    # Windows 11 24H2 / Server 2025

}

try {
    $os = Get-BuildString
    $bl = Get-BitLockerSummary

    Write-Output "Host OS      : $($os.ProductName) $($os.DisplayVersion)"
    Write-Output "Build        : $($os.FullBuild)"
    Write-Output "BitLocker    : ProtectionStatus=$($bl.ProtectionStatus); EncryptionMethod=$($bl.EncryptionMethod); KeyProtectors=$($bl.KeyProtectors)"

    if (-not $thresholds.ContainsKey($os.CurrentBuild)) {
        Write-Output "UNKNOWN - Build $($os.CurrentBuild) is not in the maintained CVE-2025-48804 threshold map. Validate manually against current vendor guidance."
        exit 2
    }

    $fixedUbr = [int]$thresholds[$os.CurrentBuild]

    if ($os.UBR -lt $fixedUbr) {
        Write-Output "VULNERABLE - Installed build $($os.CurrentBuild).$($os.UBR) is below fixed threshold $($os.CurrentBuild).$fixedUbr for CVE-2025-48804."
        exit 1
    }
    else {
        Write-Output "PATCHED - Installed build $($os.CurrentBuild).$($os.UBR) meets or exceeds fixed threshold $($os.CurrentBuild).$fixedUbr for CVE-2025-48804."
        Write-Output "NOTE: This script checks patch level only. Public downgrade research also makes Secure Boot CA 2023 / DBX state and BitLocker protector type operationally important."
        exit 0
    }
}
catch {
    Write-Output "UNKNOWN - Failed to evaluate host: $($_.Exception.Message)"
    exit 2
}

Sources

1. NVD CVE-2025-48804
2. Microsoft Security Update Guide
3. Microsoft STORM BitUnlocker research
4. BitUnlocker public PoC
5. Microsoft KB5025885 Secure Boot revocation guidance
6. Microsoft Learn BitLocker countermeasures
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS project