GreatXML Zero-Day Bypasses BitLocker via Windows Recovery Environment

A publicly disclosed zero-day dubbed GreatXML can bypass BitLocker by abusing the Windows Recovery Environment (WinRE) state used during Microsoft Defender Offline Scan, allowing an attacker to obtain a SYSTEM shell and access an encrypted volume without a normal login. Reports say the attack works by placing a crafted unattend.xml file and a Recovery directory on the recovery partition, then rebooting the device into recovery mode, where Windows processes the malicious XML and exposes an unrestricted shell. The proof of concept was demonstrated on Windows 11 24H2 build 10.0.26100.1, and systems that have previously run Defender Offline Scan are described as especially exposed because the required recovery artifacts may already be present.

The exploit was published by security researcher Chaotic Eclipse, also known as Nightmare Eclipse or MSNightmare, and no official patch was available at the time of reporting. The attack appears to require brief physical access or another method of writing to the recovery partition, raising risks for stolen laptops, insider threats, and supply-chain tampering. Microsoft said it was assessing the issue and working on protections and patches, while criticizing the public release of proof-of-concept code as irresponsible amid a broader dispute with the researcher over vulnerability disclosure and bug bounty handling.