Security researchers say attackers with physical access can bypass BitLocker protections on vulnerable Windows devices.
Microsoft has issued mitigation guidance for a newly disclosed security vulnerability known as the YellowKey BitLocker flaw, which researchers say can bypass protections built into Windows encryption systems.
The vulnerability, officially tracked as CVE-2026-45585, affects multiple versions of Windows 11 and Windows Server 2025. Attackers can exploit the flaw if they gain physical access to a vulnerable device.
Cybersecurity researchers warn that the issue could allow attackers to bypass BitLocker protections and gain access to encrypted user data.
What Is the YellowKey BitLocker Flaw?
BitLocker is Microsoft’s built-in full-disk encryption feature for Windows devices. It protects data by encrypting storage drives and linking encryption keys to the Trusted Platform Module, commonly known as TPM.
The TPM verifies that the system’s boot process has not been altered before releasing the encryption key. This security model helps protect data even if someone steals the device or removes the storage drive.
However, researchers say the YellowKey BitLocker flaw does not target the encryption itself.
Instead, the issue affects the Windows Recovery Environment surrounding BitLocker protections.
“The vulnerability is not in the encryption itself, but in the recovery environment that surrounds BitLocker,” the Netherlands’ National Cyber Security Centre reportedly explained.
The flaw became public after a security researcher known as Nightmare Eclipse disclosed the vulnerability as a zero-day exploit. The researcher reportedly released the information after expressing frustration with Microsoft’s handling of bug reports.
Researchers also published a proof-of-concept exploit that other attackers can reportedly use with relative ease.
Microsoft Releases Mitigation Steps
Microsoft has not yet released a full security patch for the YellowKey BitLocker flaw, but the company has provided temporary mitigation guidance.
The company recommends two primary mitigation options:
- Removing a vulnerable Windows Recovery Environment value linked to autofstx.exe
- Enabling BitLocker PIN protection alongside TPM security
Security analyst Will Dormann confirmed that the first mitigation prevents the FsTx Auto Recovery Utility from launching automatically during the Windows Recovery Environment startup process.
The second mitigation method involves adding a PIN requirement to BitLocker protection.
However, Nightmare Eclipse previously claimed they are withholding another proof-of-concept exploit capable of bypassing TPM-plus-PIN protections as well.
Researcher Behind YellowKey Previously Exposed Other Flaws
The researcher behind the YellowKey BitLocker flaw has previously disclosed several other Microsoft vulnerabilities.
Those include BlueHammer, a Windows local privilege escalation vulnerability, RedSun, another Windows privilege escalation flaw, and UnDefend, which reportedly allowed attackers to interfere with Microsoft Defender updates or disable protections entirely.
The repeated disclosures have increased pressure on Microsoft to strengthen Windows security protections and improve how it handles vulnerability reports from independent researchers.
Why the YellowKey BitLocker Flaw Matters
Although attackers need physical access to exploit the vulnerability, security experts say the flaw remains serious because BitLocker is widely used by businesses, governments, and individual users to secure sensitive information.
Devices used in corporate environments, remote work settings, or public travel situations could face elevated risks if attackers gain temporary physical access.
The case also highlights growing tensions between independent security researchers and major technology companies over vulnerability disclosure processes and patch response times.
For now, Microsoft urges affected users and organizations to apply the available mitigations until an official fix becomes available.
