Morse

**Name of the Vulnerable Software and Affected Versions** Windows 11 versions 24H2 and later Windows Server versions 2022 through 2025 **Description** YellowKey is a security feature bypass affecting the BitLocker component. An attacker with physical access to a device can bypass full-disk encryption to gain unauthorized access to protected information without the recovery key. The issue exploits the Windows Recovery Environment (WinRE) by using a malicious `System Volume InformationFsTx` directory placed on a USB drive or the EFI partition. By replaying NTFS transaction logs, the attacker can delete the `winpeshl.ini` file, forcing WinRE to drop to a command prompt (`cmd.exe`) while the volume remains transparently decrypted by the TPM. This allows the use of the `manage-bde` command to extract the BitLocker Recovery Key. This flaw specifically impacts systems using TPM-only deployments; configurations using TPM+PIN are not exploitable. **Recommendations** For Windows 11 versions 24H2 and later and Windows Server versions 2022 through 2025, apply the security update provided by Microsoft. As a temporary mitigation, switch BitLocker configuration from TPM-only to TPM plus PIN. As a temporary mitigation, remove `autofstx.exe` from the WinRE `BootExecute` configuration. Restrict and harden the Windows Recovery Environment (WinRE) and tighten BIOS and UEFI protections. Enforce strict physical access controls and implement tamper monitoring on endpoints.