Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

"Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as 'YellowKey,'. The proof of concept for this vulnerability has been made public, violating coordinated vulnerability best practices."

"YellowKey was disclosed by a security researcher named Chaotic Eclipse (aka Nightmare-Eclipse). It essentially allows placing specially crafted 'FsTx' files on a USB drive or EFI partition, plugging the USB drive into the target Windows computer with BitLocker protections turned on, rebooting into the Windows Recovery Environment (WinRE), and triggering a shell with unrestricted access by holding down the CTRL key."

"If you did everything properly, a shell will spawn with unrestricted access to the BitLocker protected volume, the researcher noted in a GitHub post. Redmond noted that successful exploitation could permit an attacker with physical access to sidestep the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data."

"To address the risk, the following mitigations have been outlined: Mount the WinRE image on each device. Mount the system registry hive of the mounted WinRE image. Modify BootExecute by removing "autofstx.exe" value from Session Manager's BootExecute REG_MULTI_SZ value. Save and unload Registry hive. Unmount and commit the updated WinRE image. Reestablish BitLocker trust for WinRE."

Microsoft released a mitigation for a BitLocker security feature bypass vulnerability publicly referred to as YellowKey. The flaw is tracked as CVE-2026-45585 with a CVSS score of 6.8. It affects Windows 11 26H1, 24H2, and 25H2 for x64-based systems, and Windows Server 2025 including Server Core installations. The vulnerability enables placing specially crafted FsTx files on a USB drive or EFI partition, rebooting into Windows Recovery Environment, and triggering an unrestricted shell by holding the CTRL key. Successful exploitation with physical access can bypass BitLocker Device Encryption and allow access to encrypted data. The mitigation involves mounting the WinRE image, mounting and editing the registry hive to remove the autofstx.exe entry from BootExecute, saving changes, unmounting the image, and reestablishing BitLocker trust for WinRE.

Read at The Hacker News