Skip to main content
Mallory
Medium1 public exploit

YellowKey BitLocker WinRE security feature bypass

CVE-2026-45585, publicly referred to as YellowKey, is a Windows BitLocker security feature bypass affecting the Windows Recovery Environment (WinRE) rather than the BitLocker cryptography itself. Public reporting and Microsoft mitigation guidance indicate the issue is rooted in WinRE behavior around the FsTx Auto Recovery Utility (autofstx.exe), which automatically replays crafted NTFS transaction recovery data during recovery boot. An attacker can stage specially crafted FsTx files on removable media or in the EFI System Partition so that, when the target is booted into WinRE, the replay deletes or alters winpeshl.ini and causes WinRE to launch an unrestricted command shell instead of the normal restricted recovery interface. At that point, on TPM-only BitLocker configurations, the protected volume has already been transparently unlocked by the TPM, giving the attacker access to the decrypted system volume. Reported affected platforms include Windows 11 24H2, 25H2, and 26H1 on x64 systems and Windows Server 2025; some reporting also states Windows Server 2022 was affected in testing. Microsoft had issued mitigation guidance but, per the provided content, no security update was yet available at publication time.

Share:
Stay ahead

Get ahead of vulnerabilities like this

Mallory continuously monitors global threat intelligence and correlates it with your attack surface — so you know if you’re exposed before adversaries strike.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. For analysts and engineers who need to decide and keep moving.

Impact

What an attacker gets — and what they’ve been doing with it.

Successful exploitation allows an attacker with physical access to bypass BitLocker's intended pre-boot protection on affected TPM-only systems and obtain access to data on the encrypted system volume without recovering or brute-forcing BitLocker keys. The attacker can reach an unrestricted shell in WinRE, reportedly with SYSTEM-level context, and read or manipulate files on the now-unlocked volume. This undermines the confidentiality guarantees expected from full-disk encryption for stolen, seized, unattended, or otherwise physically accessible devices. Because the attack occurs in WinRE before the normal OS environment is running, conventional endpoint controls may have limited visibility or prevention capability during exploitation.

Mitigation

If you can’t patch tonight, do this now.

Primary mitigations described in the content are: 1) disable the vulnerable WinRE behavior by removing the autofstx.exe BootExecute entry from the mounted WinRE image; 2) enable BitLocker startup PIN protection instead of TPM-only protection, because the public attack path depends on automatic TPM-based volume unlock; 3) reduce physical attack opportunities through stronger device custody controls; and 4) monitor for suspicious staging artifacts such as System Volume Information\FsTx on removable media or the EFI System Partition. Disabling WinRE entirely may also remove the published attack path, but this has operational impact because it disables recovery features such as Reset this PC, startup repair, and related recovery workflows.

Remediation

Patch, then assume compromise.

Apply Microsoft's security update when it becomes available. Until then, Microsoft guidance in the provided content recommends manually modifying the WinRE image on affected devices to disable the vulnerable automatic execution path: mount the WinRE image, load its registry hive, remove the autofstx.exe entry from the Session Manager BootExecute REG_MULTI_SZ value, unload and commit the image, and then re-establish BitLocker trust for WinRE, for example by disabling and re-enabling WinRE as documented by Microsoft. Organizations should also transition BitLocker deployments from TPM-only to TPM+PIN where operationally feasible, and enforce that configuration through Group Policy or Intune for newly deployed or reconfigured systems.
PUBLIC EXPLOITS

Exploits

No valid public exploits — Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView all

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Microsoft CorporationWindowsoperating_system
Microsoft CorporationWindows 11 24h2operating_system
Microsoft CorporationWindows 11 25h2operating_system
Microsoft CorporationWindows 11 26h1operating_system
Microsoft CorporationWindows Server 2025operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles against your asset inventory in the product.

ACTIVITY FEED

Recent activity

49 sources tracked across advisories, community write-ups, and news. Mallory keeps watching after this page renders.

49 SOURCESView all
eclypsium blogNews
May 20, 2026
YellowKey: The Unpatched BitLocker Bypass Hidden in Windows Recovery - Eclypsium | Supply Chain Security for the Modern Enterprise

A Windows Recovery Environment (WinRE) BitLocker bypass that abuses NTFS transaction log replay via System Volume Information\FsTx to delete winpeshl.ini and obtain a command shell after TPM-based transparent unlock, enabling access to BitLocker-protected drives with physical access.

Read more
security affairsNews
May 20, 2026
Microsoft issues YellowKey mitigation, no patch yet

A BitLocker security feature bypass in Windows that allows an attacker with physical access to gain a shell with access to a BitLocker-protected volume by abusing the WinRE FsTx Auto Recovery Utility (autofstx.exe).

Read more
cyber security newsNews
May 20, 2026
Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0-Day Vulnerability

A Windows BitLocker security feature bypass vulnerability in WinRE that can allow an attacker with physical access to bypass BitLocker device encryption and access encrypted data without user credentials or decryption keys.

Read more
the hacker newsNews
May 20, 2026
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

A BitLocker security feature bypass vulnerability in Windows that can allow an attacker with physical access to bypass BitLocker device encryption protections and access encrypted data.

Read more
help net securityNews
May 20, 2026
Microsoft provides mitigation for "YellowKey" BitLocker bypass flaw (CVE-2026-45585) - Help Net Security

A BitLocker security feature bypass vulnerability in Windows that allows attackers with physical access to bypass BitLocker protections and access data. The issue is described as affecting the recovery environment around BitLocker rather than the encryption itself.

Read more
reddit netsecNews
May 20, 2026
CVE-2026-45585: Windows BitLocker - YellowKey Recovery Bypass Analysis : r/netsec

A reported zero-day bypass of Windows BitLocker that abuses the Windows Recovery Environment and crafted FsTx recovery files on a USB stick to gain a SYSTEM shell and full volume access without password cracking or a TPM exploit.

Read more
The operational view lives in Mallory

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t — which of your assets are affected, which threat actors are using it right now, which detections to deploy, and what to do next.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules — auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity43

Community discussion across Reddit, Mastodon, and other social sources.