Listen to this Post
Introduction
BitLocker, Microsoft’s flagship full-volume encryption solution, has long been considered a cornerstone of Windows security—particularly for protecting data against physical theft. Yet recent research presented at Pass the SALT 2026 by Cassius Garat reveals a troubling reality: the default TPM-only BitLocker configuration remains vulnerable to sophisticated downgrade attacks that can decrypt and mount protected drives in minutes. These attacks exploit fundamental design decisions in the Secure Boot and TPM trust chain, allowing adversaries with physical access to bypass encryption without credentials, specialized hardware, or even opening the device chassis.
Learning Objectives
- Understand the technical mechanics of BitLocker downgrade attacks, including BitPixie (CVE-2023-21563) and BitUnlocker (CVE-2025-48804)
- Learn how to assess organizational exposure to downgrade attacks using built-in Windows tools
- Implement practical mitigations including PCR 4 enablement, Secure Boot certificate rollouts, and pre-boot authentication
- Understanding the BitLocker Trust Chain and Its Weaknesses
BitLocker’s security model relies on the Trusted Platform Module (TPM) to seal the Volume Master Key (VMK) against an expected boot state. The VMK unlocks the Full Volume Encryption Key (FVEK), which ultimately decrypts the disk data. When a system boots normally, the TPM releases the sealed VMK only if the measured boot state—recorded in Platform Configuration Registers (PCRs)—matches the expected values.
The critical weakness lies in which PCRs BitLocker measures by default. On modern systems with Secure Boot enabled, BitLocker only seals the VMK to PCR 7 and PCR 11. PCR 7 records the Secure Boot state—specifically, the signing certificate of the boot binaries—while PCR 11 tracks BitLocker access control. PCR 4, which records the actual hash of the boot binary itself, is disabled by default.
This design choice creates a fatal gap: an attacker can swap a legitimate, properly signed boot manager with an older, vulnerable version signed by the same certificate, and PCR 7 will remain unchanged. The TPM releases the key because the signature passes validation, even though the binary is different and contains known vulnerabilities. As the presentation notes, “Different binaries, same certificate → same PCR 7”.
Checking Your System’s Exposure
To determine if your system is vulnerable to downgrade attacks, run the following from an elevated Command
manage-bde -protectors -get c:
Look for output showing PCR 7 and PCR 11 as the only protectors. Then check the boot manager signing certificate:
mountvol s: /s sigcheck s:\EFI\Microsoft\Boot\bootmgfw.efi
If the output shows PCA 2011 as the signer, your system is vulnerable—the older certificate is still trusted, and downgrade attacks remain possible.
2. BitPixie (CVE-2023-21563): The Original Downgrade Attack
BitPixie, discovered by Rairii in August 2022 and assigned CVE-2023-21563, represents the first major software-based BitLocker downgrade attack. The vulnerability exploits a flaw in the boot manager’s handling of network boot operations: when a PXE (Preboot Execution Environment) boot fails, the Volume Master Key is not properly wiped from memory.
Attack Workflow
Step 1: The attacker configures a PXE boot server hosting an older, vulnerable version of bootmgfw.efi—still signed by the trusted PCA 2011 certificate.
Step 2: The target system is configured to network-boot via PXE. Because the older boot manager carries a valid signature from the same certificate trusted by Secure Boot, PCR 7 remains unchanged.
Step 3: The TPM releases the VMK, unlocking the disk. However, the vulnerable boot manager leaves the VMK in memory after an error condition.
Step 4: The attacker soft-reboots into a Linux kernel and scrapes the system RAM, locating the VMK by searching for the -FVE-FS- marker. The kernel exploit (often CVE-2024-1086) facilitates memory access.
Step 5: With the VMK extracted, the attacker can mount and decrypt the BitLocker-protected volume with full read/write access.
Practical Implications
Once the disk is unlocked, an attacker can:
- Replace SYSTEM binaries for privilege escalation
- Rename EDR protected folders to prevent security software from loading on next boot
- Exfiltrate sensitive data at will
As one researcher noted, all an attacker needs is “a LAN cable and keyboard” to execute the attack.
3. BitUnlocker (CVE-2025-48804): The Evolution of Downgrade Attacks
Building on the BitPixie concept, Microsoft’s STORM team (Leviev & Ben Simon) discovered BitUnlocker, a family of vulnerabilities including CVE-2025-48804. This attack targets the Windows Recovery Environment (WinRE) rather than PXE boot.
Attack Workflow
Step 1: The attacker boots the target system from a USB device containing an older, vulnerable version of the Windows Boot Manager.
Step 2: Because the older boot manager is still signed by the trusted PCA 2011 certificate, Secure Boot accepts it. PCR 7 remains unchanged, and the TPM releases the VMK.
Step 3: The attacker boots into WinRE from the recovery volume. The WinRE environment is automatically unlocked by BitLocker, gaining full access to the C: drive.
Step 4: A parsing flaw in the boot manager allows the attacker to boot a modified WinRE environment with a command prompt. From there, the attacker can mount the decrypted disk and execute arbitrary commands.
Key Advantages Over BitPixie
- No external OS required—the attack uses native Windows components
- No PXE dependency—a simple USB drive suffices
- Faster execution—typically under 5 minutes to unlock the disk
- No Linux kernel exploit needed—the attack stays within the Windows ecosystem
Microsoft patched the underlying vulnerability in July 2025, but the downgrade vector remains effective on systems still trusting the PCA 2011 certificate.
- Why Microsoft Hasn’t Fixed This—The PCR 4 Dilemma
The obvious solution would be to enable PCR 4 measurement, binding the VMK to the actual hash of the boot binary rather than just its signature. However, Microsoft attempted this in 2024 and faced a catastrophic outcome: recovery screens appeared on every affected machine.
The Problem Explained
When PCR 4 is enabled, any change to the boot binary—including legitimate Windows updates, firmware updates, or boot manager patches—changes the PCR 4 hash. The TPM no longer recognizes the boot state as valid, and BitLocker prompts for the recovery key on every boot. The update was pulled within a month due to overwhelming user complaints.
As the presentation wryly notes: “Re-enabling PCR 4 would break things”. Microsoft finds itself in a difficult position: security versus usability, and usability has won—for now.
5. Certificate Rollout: The 2026 Mitigation Path
Microsoft’s long-term solution involves rolling out a new Secure Boot certificate: Windows UEFI CA 2023, which will eventually replace the aging PCA 2011 certificate.
The Timeline
- PCA 2011 expires in October 2026
- PCA 2023 ships by default in new Windows 11 installations
- Once PCA 2011 is fully distrusted, firmware will reject older boot binaries, breaking downgrade attacks
The Gap
However, organizations are rolling out the new certificate slowly in practice. As of mid-2026, many enterprise environments still have devices signed with PCA 2011, leaving them vulnerable.
Checking Certificate Status
To verify which certificate your system trusts:
mountvol s: /s sigcheck -1 s:\EFI\Microsoft\Boot\bootmgfw.efi
Look for PCA 2011 (vulnerable) or PCA 2023 (protected against known downgrades).
6. Practical Mitigations for Organizations
6.1 Enable Pre-Boot Authentication (PIN)
Configuring BitLocker with a TPM + PIN protector prevents automatic key release during boot. Even if the downgrade attack succeeds in bypassing Secure Boot, the attacker still needs the PIN to unlock the disk.
Caution: PINs derived from hostnames via Group Policy are guessable. Use strong, unique PINs.
6.2 Apply KB5025885 and Revoke PCA 2011
Microsoft’s KB5025885 introduces the REVISE mitigation, which:
- Distrusts the PCA 2011 certificate
- Enrolls the Windows UEFI CA 2023 certificate
- Ships a 2023-signed boot manager
To apply:
wusa.exe kb5025885 /quiet /norestart
Important: This mitigation must be applied manually and requires careful planning to avoid recovery key prompts.
6.3 Enable PCR 4 (With Caution)
For high-security environments willing to accept the user experience impact:
Enable PCR 4 measurement manage-bde -protectors -add c: -tpm -pcr 0,2,4,11
Test thoroughly in a staging environment before deploying to production.
6.4 Disable PXE and USB Boot in BIOS/UEFI
While not a complete solution, disabling external boot sources raises the bar for physical attacks.
6.5 Vulnerability Assessment Command
Run this comprehensive check across your Windows fleet:
Check BitLocker protector configuration Get-BitLockerVolume -MountPoint "C:" | Select-Object Verify PCR binding manage-bde -protectors -get c: Check Secure Boot certificate mountvol s: /s sigcheck s:\EFI\Microsoft\Boot\bootmgfw.efi
7. Future of Downgrade Attacks
The downgrade attack landscape is evolving rapidly. Recent BitLocker vulnerabilities suggest a wave of new boot-path bugs that will become downgrade candidates. While PCA 2023 rollout will close the current vector, attackers are already exploring:
- Downgrade attacks targeting 2023-signed boot files
- WinRE integrity bypasses—the recovery image is integrity-checked, but future vulnerabilities may circumvent this
- Hardware attacks including TPM bus sniffing, DMA, and cold-boot attacks
As the presentation concludes: “Where downgrades are hard” includes bootmgfw.efi (old versions still boot current Windows), winload.efi (harder—old loaders can’t boot modern kernels), and WinRE (integrity-checked). But “hard” is not “impossible.”
What Undercode Say
- The default TPM-only BitLocker configuration is fundamentally broken against physical attacks. Organizations relying solely on BitLocker without additional protections are exposing themselves to significant risk. The downgrade attacks are not theoretical—they have public proof-of-concept code and can be executed in minutes.
-
Microsoft’s usability-security tradeoff has created a decade-long vulnerability window. The decision to disable PCR 4 by default, and the failed 2024 attempt to re-enable it, highlights a systemic tension. Enterprises must take proactive measures rather than waiting for Microsoft to solve the problem.
-
The PCA 2023 rollout is necessary but insufficient. While it closes the current downgrade vector, attackers will shift focus to new boot-path vulnerabilities. Organizations should treat this as an ongoing cat-and-mouse game rather than a one-time fix.
-
PIN protection is not a silver bullet. While it raises the bar, PINs can be guessed (especially when derived from hostnames) and do not protect against insider threats with knowledge of their own PIN. Hardware attacks like TPM bus sniffing can also extract keys even with PIN protection.
-
Defense-in-depth remains the only viable strategy. Physical security, BIOS/UEFI hardening, endpoint detection, and careful BitLocker configuration must work together. No single control can adequately protect against determined adversaries with physical access.
Prediction
-1 The PCA 2011 certificate expiration in October 2026 will create a period of heightened risk as organizations rush to migrate. Attackers will exploit the transition window aggressively, targeting systems that have not yet completed the rollout.
-1 A new wave of BitLocker downgrade vulnerabilities targeting PCA 2023-signed binaries will emerge within 12-18 months. The attack surface—boot managers, loaders, and recovery environments—will continue to yield exploitable flaws.
-1 Hardware-based attacks (TPM bus sniffing, DMA, cold-boot) will become more accessible as tools and techniques commoditize. What currently requires specialized equipment and expertise may soon be executable with off-the-shelf hardware.
+1 The pressure from these attacks will accelerate Microsoft’s security investments in the boot chain. Expect more robust protections—including mandatory PCR 4 enablement or equivalent alternatives—in future Windows releases, potentially as early as 2027.
+1 Organizations that proactively implement the mitigations outlined above (KB5025885, PCA 2023 rollout, and PIN protection) will gain a significant security advantage over peers who wait for Microsoft to mandate changes. Early adopters will avoid the chaos of last-minute migrations.
-1 However, the fundamental tension between security and usability means that truly secure BitLocker configurations will remain difficult to deploy at scale. Recovery key management, user education, and help desk overhead will continue to be barriers to comprehensive protection.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Aleborges Windows – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
