Loading vulnerability…
Windows BitLocker WinRE Apps Scheduled Operation Security Feature Bypass
CVE-2025-48003 is a protection mechanism failure in Windows BitLocker that allows an unauthorized attacker with physical access to bypass BitLocker Device Encryption on the system storage device. The issue is associated with the Windows Recovery Environment (WinRE) attack surface and specifically with WinRE Apps scheduled-operation handling. In the vulnerable design, SetupPlatform.exe remained trusted in WinRE after Windows Upgrade because its allow-list entry was not removed. Researchers found that SetupPlatform.exe could register the Shift+F10 hotkey to launch a command prompt without triggering the expected BitLocker re-lock behavior. By using an INI-controlled execution path to force a blocking message box, an attacker could create a sufficient interaction window to trigger the hotkey and obtain cmd.exe while the operating system volume was in WinRE auto-unlock state. This enables bypass of the BitLocker protection boundary and access to data on the encrypted system volume.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows bypass of the BitLocker Device Encryption security feature on the system storage device. An attacker with physical access can obtain access to the TPM-unlocked volume during WinRE processing, which can expose encrypted data and undermine confidentiality protections at rest. The associated CVSS assessment also reflects potential high impact to confidentiality, integrity, and availability once the protection boundary is bypassed.
If you can’t patch tonight, do this now.
Where patching cannot be performed immediately, reduce exposure by hardening BitLocker pre-boot protections and recovery workflows. Microsoft recommended enabling TPM+PIN for pre-boot authentication and enabling the REVISE mitigation to reduce BitLocker attack surface and downgrade risk. Restricting physical access to devices is also important because exploitation requires hands-on access to the target.
Patch, then assume compromise.
Apply the Microsoft security updates released in July 2025 for affected Windows versions. Microsoft states this vulnerability was fixed in the July 2025 Patch Tuesday release. Organizations should ensure WinRE-related BitLocker fixes are fully deployed across affected endpoints and servers.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.