Loading vulnerability…
Windows BitLocker WinRE SDI Trusted WIM Boot Bypass
CVE-2025-48804 is a Windows BitLocker security feature bypass vulnerability in the Windows Recovery Environment boot chain. The flaw is rooted in Boot.sdi and ramdisk handling during Trusted WIM Boot: the boot environment validates a legitimate trusted WIM image, but does not properly bind that verification to the WIM image actually loaded from the SDI-specified offset. This acceptance of extraneous untrusted data with trusted data allows an attacker to append or reference an attacker-controlled WIM while still satisfying integrity checks on the trusted portion. In practical exploitation, a modified WinRE image can be booted while the operating system volume has already been automatically unlocked by BitLocker, enabling execution in the recovery environment with access to the decrypted volume. Public reporting also describes downgrade-based exploitation using older still-trusted boot manager binaries on systems that continue to trust legacy Secure Boot signing certificates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses BitLocker Device Encryption and Trusted WIM Boot protections on affected systems. An attacker with physical access can boot an attacker-controlled WinRE environment after the TPM has released the volume key, gaining access to the decrypted operating system volume. This can enable reading and extraction of protected data and secrets from the disk, launching a command shell in the recovery environment, modifying system state offline, and potentially causing high confidentiality, integrity, and availability impact consistent with Microsoft's CVSS assessment.
If you can’t patch tonight, do this now.
Enable BitLocker pre-boot authentication such as TPM+PIN to prevent transparent TPM-only auto-unlock during attacker-controlled boot flows. Reduce downgrade exposure by migrating systems to Windows UEFI CA 2023 trust, applying available boot manager revocation controls, and removing trust in legacy boot manager signing where operationally feasible. Environments with elevated physical-threat models should also review WinRE exposure and harden or restrict recovery pathways as appropriate.
Patch, then assume compromise.
Apply Microsoft's July 2025 security updates that fix CVE-2025-48804, including the updated boot manager components. Because public research indicates downgrade paths may remain viable where legacy Secure Boot trust persists, full remediation should also include Microsoft's boot manager rollback protections and Secure Boot trust migration measures, including the relevant revocation and certificate migration guidance associated with KB5025885 and Windows UEFI CA 2023 where applicable.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.