Microsoft Issues Mitigations for YellowKey Windows BitLocker Zero-Day
Summary
Microsoft is tracking the publicly disclosed YellowKey BitLocker flaw as CVE-2026-45585 and advises removing autofstx.exe from BootExecute, restoring WinRE trust, and using TPM+PIN until a security update is available.
Key points
- Microsoft identifies YellowKey as a Windows security-feature bypass affecting BitLocker-protected drives and tracks it as CVE-2026-45585.
- A public proof of concept reportedly uses crafted FsTx files, WinRE, and a CTRL-key action to access a protected volume.
- Microsoft advises removing autofstx.exe from the Session Manager's BootExecute value and reestablishing BitLocker trust for WinRE.
- Microsoft recommends changing already encrypted devices from TPM-only to TPM+PIN; administrators can require a startup PIN when configuring encryption.
- Microsoft says the mitigation is intended to protect against potential attacks until a security update is available; the article does not confirm YellowKey exploitation in the wild.
Article Details
- Vulnerability Types
- BitLocker security feature bypass
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
- Workarounds
- Remove the autofstx.exe entry from the Session Manager's BootExecute REG_MULTI_SZ value and reestablish BitLocker trust for WinRE.
- On already encrypted devices, change BitLocker from TPM-only to TPM+PIN mode.
- On devices not yet encrypted, enable Require additional authentication at startup and set Configure TPM startup PIN to Require startup PIN with TPM.
CVE
CVE-2026-33825Last month, they also disclosed the BlueHammer (CVE-2026-33825) and RedSun (no identifier) local privilege escalation (LPE) zero-day flaws, both of which are now being exploited in attacks.CVE-2026-45585Microsoft has issued mitigations for YellowKey, a newly disclosed Windows BitLocker zero-day tracked as CVE-2026-45585 that can let attackers access protected drives.
People
Nightmare EclipseThe anonymous security researcher who disclosed YellowKey and published its proof of concept; the article also says they disclosed BlueHammer and RedSun.Will DormannPrincipal vulnerability analyst at Tharros who explained how removing autofstx.exe prevents the FsTx Auto Recovery Utility from starting in WinRE.
Vendors
Products
BitLockerMicrosoft has issued mitigations for YellowKey, a newly disclosed Windows BitLocker zero-day tracked as CVE-2026-45585 that can let attackers access protected drives.Microsoft WindowsMicrosoft has issued mitigations for YellowKey, a newly disclosed Windows BitLocker zero-day tracked as CVE-2026-45585 that can let attackers access protected drives.