# Microsoft Patches Critical BitLocker Bypass as Public Exploit 'YellowKey' Widens Attack Surface
Microsoft has rolled out mitigations for CVE-2026-45585, a critical zero-day vulnerability allowing attackers with physical access to bypass BitLocker encryption entirely. The flaw, publicly disclosed as "YellowKey" by researcher Chaotic Eclipse, can be exploited using a USB drive containing readily available exploit code, making it an immediate threat to organizations protecting sensitive data through full-disk encryption.
## The Threat
BitLocker has long served as a cornerstone of Windows endpoint security, particularly in regulated industries requiring data-at-rest protection. The encryption feature is mandated by standards including HIPAA, PCI-DSS, and various government compliance frameworks. YellowKey fundamentally undermines this protection layer by allowing an attacker to completely circumvent BitLocker's encryption protection through a chain of pre-boot vulnerabilities.
The attack chain is deceptively simple: an attacker with physical access to a Windows system reboots the device into recovery mode while a USB drive containing the YellowKey exploit is present. Instead of launching the normal Windows Recovery Environment (WinRE), the exploit successfully spawns an unauthenticated command shell with full access to the encrypted partition. The attacker can then browse, copy, or modify encrypted data without ever providing a BitLocker recovery key.
The vulnerability exploits a critical flaw in how Microsoft's File System Transaction (FsTx) Auto Recovery utility handles Transactional NTFS operations during WinRE startup. The exploit uses a specially crafted FsTx directory on the USB drive to trigger deletion of the winpeshl.ini file—the configuration file that controls WinRE's behavior—thereby subverting the entire recovery environment. What makes this particularly concerning is Chaotic Eclipse's assertion that the bypass works *even on systems with TPM-only BitLocker protection supplemented by a PIN*, suggesting that Microsoft's primary recommended mitigation may not fully address the underlying vulnerability.
## Severity and Impact
| Metric | Details |
|---|---|
| CVE Identifier | CVE-2026-45585 |
| CVSS v3.1 Score | 6.8 (Medium) |
| Vector String | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Physical (requires USB drive + system restart) |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
| CWE | CWE-269 (Improper Access Control to Privileged Functionality) |
| Exploit Status | Public exploit available |
## Affected Products
## Mitigations
Microsoft's official mitigation involves a complex multi-stage remediation process:
Immediate Actions:
Step-by-Step Mitigation Process:
1. Boot into a known-good Windows environment
2. Mount the WinRE partition
3. Mount the system registry hive from the WinRE image
4. Locate and remove autofstx.exe from the mounted hive
5. Unmount and update the WinRE image
6. Reestablish BitLocker protection for the WinRE image using management tools
7. Re-enable WinRE
Administrative Recommendations:
Long-Term Controls:
## References
---
## HackWire Analysis
While the CVSS score of 6.8 might suggest moderate risk, YellowKey represents a fundamental failure in pre-boot security architecture—and the physical-access requirement shouldn't lull enterprises into complacency. Consider the practical attack surface: data center techs, cleaning staff with after-hours access, border security inspections, supply chain intercepts, and insider threats all have legitimate physical proximity to high-value systems. In sectors like healthcare, finance, and government, the ability to walk up to a system and extract encrypted patient records, transaction logs, or classified data in under five minutes is a catastrophic control failure.
The more concerning pattern is what security researcher Will Dormann highlighted: the underlying FsTx cross-volume manipulation vulnerability itself. The fact that a Transactional NTFS directory on one volume can modify or delete files on another volume during replay is architecturally suspect. This isn't just a BitLocker bypass—it's a potentially broader privilege escalation and data manipulation vector that may have exploitation paths beyond WinRE. Microsoft should initiate a full audit of FsTx behavior across all boot scenarios and kernel operations.
Chaotic Eclipse's claim that TPM+PIN protection fails is equally alarming. If true, it suggests Microsoft's own recommended defense-in-depth strategy is incomplete, and defenders relying on PIN-protected BitLocker may have a false sense of security while this exploit is public and actively used. The researcher's apparent grudge (described as "disgruntled") against Microsoft, combined with multiple Windows zero-day releases, suggests there may be additional undisclosed bypasses in the pipeline. Organizations should treat this disclosure as a warning sign of broader pre-boot security erosion and begin threat modeling around alternate attack vectors immediately.
The silver lining: the mitigation is deployable at scale via MDM, and most organizations should have the capability to push WinRE image updates to their fleets within days. However, the complexity of the remediation process and the requirement to mount registry hives and rebuild trust relationships will likely result in significant deployment lag in less mature environments. Smaller organizations without centralized endpoint management may struggle to patch this consistently.
— HackWire Editorial
## Related Coverage