Windows 11 BitLocker vulnerability: Downgrade attack on encryption possible

The exploit is based on [CVE-2025-48804][1], a vulnerability within the Windows recovery environment and the system deployment image mechanism. Although a patch was released in July 2025, the tool uses a downgrade attack to render the protection ineffective.

To carry out the attack, an attacker must have physical access to the device. Using a USB stick, the attacker feeds the boot manager a legitimate file in Windows Imaging format. While the system performs integrity checks on this clean file and verifies it as authentic, it simultaneously boots a malicious payload attached to the file, giving the attacker access to the decrypted volume.

The core of the vulnerability lies in the continued reliance on the outdated Windows PCA 2011 certificate. Since Secure Boot continues to recognize this certificate as valid, attackers can force the system to load an older, vulnerable version of the boot manager. In this case, the Trusted Platform Module (TPM) compares the system readings with the PCA 2011 certificate. As no irregularities are detected, the TPM releases the BitLocker volume master key, allowing the drive to be unlocked without triggering security alerts.

This vulnerability particularly affects users who rely on standard TPM configurations. However, effective countermeasures are available to secure the data. Systems that use a TPM in conjunction with a pre-boot PIN are completely immune to this attack, as the hardware requires a manual code before the encryption keys are released.

The risk can also be mitigated by software updates. Devices that have completed the transition to the “Windows UEFI CA 2023” digital security certificate via update KB5025885 are protected from this specific downgrade path, as the system no longer relies on the outdated 2011 certificate. [1]: https://nvd.nist.gov/vuln/detail/CVE-2025-48804