# Windows BitLocker Vulnerabilities: Security Feature Bypass and Privilege Elevation (CVE-2026-85920, CVE-2026-88070, CVE-2026-83500)

> Microsoft's October 2026 Patch Tuesday fixes three Windows BitLocker vulnerabilities: a TOCTOU race condition (CVE-2026-85920) and an out-of-bounds read (CVE-2026-88070) that allow local privilege escalation, and an open-redirect security feature bypass requiring physical access (CVE-2026-83500). No active exploitation, public PoC or attribution has been reported.

- **Published:** 2026-10-14T07:15:12Z
- **Last reviewed:** 2026-10-14T11:27:53.428Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3476
- **ID:** TL-2026-3476
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85920, CVE-2026-88070, CVE-2026-83500

## Description

Microsoft addressed three vulnerabilities in the Windows BitLocker disk-encryption feature in the October 2026 security updates (NVD entries published 2026-10-13; press coverage 2026-10-14).

CVE-2026-85920 is a time-of-check time-of-use (TOCTOU) race condition (CWE-367) in Windows BitLocker. An authorized, authenticated local attacker can win the race to elevate privileges locally. NVD lists CVSS 3.1 7.0 (HIGH), vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the high attack complexity reflects the need to win the race.

CVE-2026-88070 is an out-of-bounds read (CWE-125) in Windows BitLocker. An authorized local attacker can read memory outside the expected bounds and elevate privileges locally. NVD lists CVSS 3.1 7.8 (HIGH), vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

CVE-2026-83500 is a URL redirection to untrusted site ('open redirect', CWE-601) condition in Windows BitLocker that lets an unauthorized attacker bypass a security feature through a physical attack. NVD lists CVSS 3.1 6.1 (MEDIUM), vector AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. It matters mainly for lost or stolen devices, where BitLocker protections are the last line of defense for data at rest.

Affected platforms per NVD: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (CVE-2026-83500 lists Server 2016-2025), on 32-bit, x64 and ARM64. NVD status for all three is 'Awaiting Analysis'. The sources do not report active exploitation, CISA KEV listing, public proof-of-concept code, threat-actor attribution or network indicators. Specific KB numbers, credits and exploit internals were not available in the sources reviewed; the Microsoft Security Update Guide pages could not be rendered by the fetch tool.

These are local/physical-vector issues rather than remote attacks. They are relevant as post-compromise privilege escalation primitives (CVE-2026-85920, CVE-2026-88070) and as a disk-encryption control bypass for physical-access scenarios (CVE-2026-83500).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1005 Data from Local System
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion

## Sources

- [Windows BitLocker Vulnerabilities Security Feature Bypass and Privilege Elevation Attacks](https://cybersecuritynews.com/windows-bitlocker-bypass-vulnerabilities/)
- [NVD - CVE-2026-88070](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-88070)
- [NVD - CVE-2026-85920](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-85920)
- [NVD - CVE-2026-83500](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-83500)
- [Microsoft Security Update Guide - CVE-2026-88070](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88070)
- [Microsoft Security Update Guide - CVE-2026-85920](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85920)
- [Microsoft Security Update Guide - CVE-2026-83500](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83500)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3476