Microsoft Mitigates YellowKey BitLocker Bypass Vulnerability
Summary
Microsoft released mitigations for CVE-2026-45585 (YellowKey), a physical-access BitLocker bypass using USB-triggered FsTx activity in Windows Recovery Environment. Chaotic Eclipse claims the exploit also works with a BitLocker PIN.
Key points
- CVE-2026-45585, scored 6.8 CVSS, can be triggered by an attacker with physical access using a USB drive and booting into Windows Recovery Environment.
- The exploit can open a shell instead of the usual recovery environment, exposing the underlying partition while BitLocker protection is bypassed.
- Microsoft's mitigation removes autofstx.exe from the mounted WinRE image and reestablishes BitLocker trust, preventing the utility from running automatically during image initiation.
- Microsoft recommends adding a PIN to BitLocker; researcher Chaotic Eclipse claims the exploit also works on systems where TPM protection is supplemented by a PIN.
- Will Dormann describes the exploit as using Transactional NTFS replay to delete winpeshl.ini via FsTx, changing WinRE's behavior.
Article Details
- Vulnerability Types
- BitLocker encryption bypass
- Transactional NTFS replay enabling modification of another volume
- Severity
- CVSS 6.8
- Exploitation Status
- reported
- Exploit Availability
- public_exploit
- Patch Status
- unknown
- Workarounds
- Microsoft rolled out mitigations that prevent autofstx.exe from automatically running during WinRE image initiation; its advisory describes removing autofstx.exe from the mounted WinRE image's system registry hive.
- Microsoft recommends adding a PIN to BitLocker, although Chaotic Eclipse claims YellowKey also works on systems protected by a PIN.
CVE
People
Vendors
Products
BitLockerMicrosoft on Tuesday rolled out mitigations for YellowKey, a recently disclosed zero-day vulnerability leading to BitLocker bypass.Microsoft WindowsInstead of serving the attacker the typical Windows Recovery Environment (WinRE), the exploit spawns a shell, offering access to the underlying partition’s contents, no longer protected by BitLocker’s encryption.Windows Recovery Environment (WinRE)Instead of serving the attacker the typical Windows Recovery Environment (WinRE), the exploit spawns a shell, offering access to the underlying partition’s contents, no longer protected by BitLocker’s encryption.