CVE-2026-45585

Name of the Vulnerable Software and Affected Versions Windows 11 versions 24H2 and later Windows Server versions 2022 through 2025

Description YellowKey is a security feature bypass affecting the BitLocker component. An attacker with physical access to a device can bypass full-disk encryption to gain unauthorized access to protected information without the recovery key. The issue exploits the Windows Recovery Environment (WinRE) by using a malicious System Volume InformationFsTx directory placed on a USB drive or the EFI partition. By replaying NTFS transaction logs, the attacker can delete the winpeshl.ini file, forcing WinRE to drop to a command prompt (cmd.exe) while the volume remains transparently decrypted by the TPM. This allows the use of the manage-bde command to extract the BitLocker Recovery Key. This flaw specifically impacts systems using TPM-only deployments; configurations using TPM+PIN are not exploitable.

Recommendations For Windows 11 versions 24H2 and later and Windows Server versions 2022 through 2025, apply the security update provided by Microsoft. As a temporary mitigation, switch BitLocker configuration from TPM-only to TPM plus PIN. As a temporary mitigation, remove autofstx.exe from the WinRE BootExecute configuration. Restrict and harden the Windows Recovery Environment (WinRE) and tighten BIOS and UEFI protections. Enforce strict physical access controls and implement tamper monitoring on endpoints.