Multiple 0-days to Bypass BitLocker and Extract All Protected Data

Researchers have disclosed a series of critical zero-day vulnerabilities that completely bypass Windows BitLocker encryption, allowing attackers with physical access to extract all protected data from encrypted devices in a matter of minutes.

The research, conducted by Alon Leviev and Netanel Ben Simon from Microsoft’s Security Testing & Offensive Research at Microsoft (STORM) team, exposes fundamental flaws in the Windows Recovery Environment (WinRE) that undermine BitLocker’s core security promise.

Four Critical Attack Vectors Discovered

The researchers identified four distinct zero-day vulnerabilities designated as CVE-2025-48800, CVE-2025-48003, CVE-2025-48804, and CVE-2025-48818, each exploiting different components of the Windows recovery system.

Boot.sdi Parsing Vulnerability (CVE-2025-48800): This attack manipulates the Boot.sdi file’s WIM offset to bypass trusted WIM validation. Attackers can substitute legitimate recovery images with malicious versions, allowing untrusted code execution while maintaining the appearance of system integrity.

ReAgent.xml Exploitation (CVE-2025-48003): The vulnerability abuses WinRE’s offline scanning feature, which is designed for antivirus operations. Researchers demonstrated using tttracer.exe, a legitimate Time Travel Debugging utility, to spawn command prompt sessions with full access to encrypted volumes.

Trusted App Manipulation (CVE-2025-48804): This exploit targets SetupPlatform.exe, a legitimately trusted application that remains registered after Windows upgrades. The attack creates an infinite time window by manipulating configuration files, allowing attackers to register keyboard shortcuts that launch privileged command prompts.

BCD Configuration Attack (CVE-2025-48818): The most sophisticated vulnerability exploits Push Button Reset (PBR) functionality by manipulating Boot Configuration Data to redirect WinRE operations. Attackers can force the system to decrypt BitLocker volumes by creating malicious ResetSession.xml files on the unprotected recovery partition.

These vulnerabilities are particularly dangerous because they operate within WinRE’s “Auto-Unlock” state, where the main OS volume remains accessible to recovery operations. Unlike traditional BitLocker bypass attempts that trigger volume re-locking, these exploits maintain full system access throughout the attack process.

According to the BlackHat2025 presentation, the attacks require only basic physical access and can be executed by anyone who can boot into WinRE using simple key combinations like Shift+F10. The researchers demonstrated complete data extraction capabilities, including accessing sensitive files, credentials, and system configurations stored on BitLocker-protected drives.

The vulnerabilities affect a comprehensive range of Windows systems, including Windows 10, Windows 11, and Windows Server editions, potentially impacting millions of enterprise and consumer devices worldwide. Microsoft has classified these as “Important” severity vulnerabilities with CVSS scores ranging from 6.8 to 7.2, though security experts argue the real-world impact could be significantly higher.

Organizations that depend on BitLocker for data protection in theft scenarios face immediate risk, particularly for mobile workforce devices and systems in unsecured environments.

Microsoft addressed these vulnerabilities in July 2025’s Patch Tuesday updates, releasing specific security patches for all affected Windows versions. The company strongly recommends that organizations implement the following countermeasures immediately:

Enable TPM+PIN authentication for pre-boot verification, which prevents these attacks by requiring user authentication before WinRE can access encrypted volumes. Deploy the REVISE mitigation for anti-rollback protection to prevent downgrade attacks. Apply all July 2025 security updates through standard Windows Update mechanisms.

This discovery represents one of the most significant challenges to Microsoft’s encryption strategy in recent years, demonstrating how trusted recovery mechanisms can become attack vectors when not properly secured.

Equip your SOC with full access to the latest threat data from ANY.RUN TI Lookup that can Improve incident response -> Get 14-day Free Trial