Loading vulnerability…
BitLocker Security Feature Bypass via WinRE BCD Parsing
CVE-2025-48818 is a Windows BitLocker security feature bypass vulnerability in the Windows Recovery Environment (WinRE) exploitation path, caused by a time-of-check time-of-use race/logic flaw in Boot Configuration Data (BCD) parsing and target OS selection. During BitLocker auto-unlock in WinRE, the platform could search available volumes for a BCD store and use the first matching store it found to determine the target operating system location. Because WinRE could inspect the recovery volume before the EFI volume, an attacker with physical access could place an attacker-controlled BCD store on the recovery volume and cause WinRE to trust attacker-influenced recovery configuration while the normal boot phase still relied on the legitimate EFI BCD store. Microsoft’s research indicates this behavior could be chained with Online Push Button Reset (PBR), ReAgent.xml scheduled operations, and a ResetSession.xml DecryptVolume directive to instruct recovery components to decrypt the BitLocker-protected operating system volume. The issue was addressed in Microsoft’s July 2025 Patch Tuesday release.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a physical attacker to bypass BitLocker’s protection goals and gain access to data on the protected operating system volume. In the documented exploit chain, the attacker can cause recovery components to decrypt the BitLocker-encrypted OS volume, undermining data-at-rest protections and enabling unauthorized access to protected information. This is a security feature bypass rather than a conventional remote code execution flaw, but it can directly defeat disk-encryption assurances on affected systems.
If you can’t patch tonight, do this now.
Where patch deployment is not yet complete, reduce exposure by enabling TPM+PIN pre-boot authentication so access to the protected volume is not based solely on TPM auto-unlock. Microsoft also recommends enabling the REVISE mitigation to reduce BitLocker attack surface and downgrade risk. Because exploitation requires physical access and abuse of WinRE/recovery components, strong physical security controls and restrictions on unauthorized offline access to devices materially reduce risk.
Patch, then assume compromise.
Apply the Microsoft security updates released in July 2025 for affected Windows versions. Microsoft states that the BCD/PBR exploit chain associated with CVE-2025-48818 was fixed in that release. Organizations should ensure WinRE-related BitLocker fixes are fully deployed across managed endpoints and servers that use BitLocker, and validate that recovery environment components are updated together with the core OS.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.