CVE-2025-26637

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26637	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_10_1507:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1507:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_22h2::::::::
	cpe:2.3:o:microsoft:windows_11_22h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_22h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_23h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_23h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::arm64:*
	cpe:2.3:o:microsoft:windows_11_24h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016::::::::
	cpe:2.3:o:microsoft:windows_server_2019::::::::
	cpe:2.3:o:microsoft:windows_server_2022:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2022_23h2:::::::x64:*
	cpe:2.3:o:microsoft:windows_server_2025:::::::x64:*

History

No history.

Information

Published : 2025-04-08 18:15

Updated : 2025-07-03 13:03

NVD link : CVE-2025-26637

Mitre link : CVE-2025-26637

CVE.ORG link : CVE-2025-26637

JSON object : View

Products Affected

microsoft

windows_server_2019
windows_10_22h2
windows_server_2022
windows_11_23h2
windows_10_1507
windows_11_24h2
windows_10_1607
windows_server_2016
windows_server_2022_23h2
windows_11_22h2
windows_server_2025
windows_server_2012

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2025-26637", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2025-04-08T18:15:47.490", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26637", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack."}, {"lang": "es", "value": "Una falla en el mecanismo de protecci\u00f3n de Windows BitLocker permite que un atacante no autorizado eluda una caracter\u00edstica de seguridad con un ataque f\u00edsico."}], "lastModified": "2025-07-03T13:03:14.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "575117BF-9A1E-4B90-85D8-4172A58B3B72", "versionEndExcluding": "10.0.10240.20978"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "B3B4804C-685B-4F37-92DE-CE73D1B106B4", "versionEndExcluding": "10.0.10240.20978"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "474622F8-06D4-4AD1-8D72-A674909A7634", "versionEndExcluding": "10.0.14393.7969"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "559D55D4-2BF2-4B8F-90CA-C6B885334A3E", "versionEndExcluding": "10.0.14393.7969"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09E0970D-79B9-40D9-BFFF-25EE5A686B04", "versionEndExcluding": "10.0.19045.5737"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "matchCriteriaId": "350A5C83-A85B-4CC1-81C6-F36C1BE0687E", "versionEndExcluding": "10.0.22621.5189"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "AAB1352F-725F-427E-A3F3-73A48287D0C7", "versionEndExcluding": "10.0.22621.5189"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "matchCriteriaId": "0A9C8BFA-DC5B-4E27-AEA1-0CF52B4FDF88", "versionEndExcluding": "10.0.22631.5189"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "1718BEDA-0AF8-4A6D-B053-AE746C7617C8", "versionEndExcluding": "10.0.22631.5189"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*", "vulnerable": true, "matchCriteriaId": "39A448D0-EB9F-42FE-85A2-A4AA88D4CEBD", "versionEndExcluding": "10.0.26100.3775"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "8B1600DE-F4B9-456C-A42F-5E5CDB2D6DEF", "versionEndExcluding": "10.0.26100.3775"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A232AB6-1EC5-44E7-AB75-0EB9A5A63259", "versionEndExcluding": "10.0.14393.7969"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2941A94-927C-4393-B2A0-4630F03B8B3A", "versionEndExcluding": "10.0.17763.7136"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "A44CFF42-6210-4ACF-B3AC-73297E9316AC", "versionEndExcluding": "10.0.20348.3453"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "0B42570D-5CFB-4620-8B06-B5752212709A", "versionEndExcluding": "10.0.25398.1551"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "AA03AE1F-F78C-4864-A1B6-15846AAD4899", "versionEndExcluding": "10.0.26100.3775"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}