BitUnlocker: Exploit Multiple 0-Day Vulnerabilities to Bypass BitLocker and Retrieve All Secured Data
Researchers have revealed a series of critical zero-day vulnerabilities that completely bypass Windows BitLocker encryption, enabling attackers with physical access to extract all protected data from encrypted devices within minutes. Conducted by Alon Leviev and Netanel Ben Simon from Microsoft’s Security Testing & Offensive Research (STORM) team, the research uncovers fundamental flaws in the Windows Recovery Environment (WinRE) that undermine BitLocker’s core security promise. Four distinct zero-day vulnerabilities have been identified, designated as CVE-2025-48800, CVE-2025-48003, CVE-2025-48804, and CVE-2025-48818, each exploiting different components of the Windows recovery system. The vulnerabilities include a Boot.sdi Parsing Vulnerability that allows untrusted code execution, ReAgent.xml Exploitation that grants full access to encrypted volumes, Trusted App Manipulation that enables privileged command prompts, and a BCD Configuration Attack that can force decryption of BitLocker volumes.
These vulnerabilities pose significant risks as they operate within WinRE’s “Auto-Unlock” state, where the main OS volume remains accessible for recovery operations. Unlike traditional BitLocker bypass attempts that trigger volume re-locking, these exploits maintain full system access throughout the attack process. According to the BlackHat2025 presentation, the attacks require only basic physical access and can be executed by anyone who can boot into WinRE using simple key combinations like Shift+F10. The researchers demonstrated complete data extraction capabilities, including access to sensitive files, credentials, and system configurations stored on BitLocker-protected drives. The vulnerabilities affect a wide range of Windows systems, including Windows 10, Windows 11, and Windows Server editions, potentially impacting millions of enterprise and consumer devices.
Categories: Zero-Day Vulnerabilities, Windows BitLocker Security Flaws, Physical Access Exploits
Tags: Zero-Day Vulnerabilities, Windows BitLocker, Encryption, Windows Recovery Environment, Attack Vectors, Boot.sdi Parsing, ReAgent.xml, Trusted App Manipulation, BCD Configuration, Physical Access