Microsoft provides mitigation for "YellowKey" BitLocker bypass flaw (CVE-2026-45585)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-45585 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable. NVD description · AI analysis pending | 6.8 | 1% | PoC |
| — |
Full article462 words · extracted from helpnetsecurity.com · click to collapse
Microsoft is working on a fix for CVE-2026-45585 (aka “Yellowkey”), a vulnerability that can be used by attackers to bypass protections offered by BitLocker, the full-disk encryption feature built into Windows, and access users’ data.
In the meantime, the company has provided step-by-step mitigation advice to protect affected Windows devices from exploitation.
CVE-2026-45585 and the YellowKey exploit
CVE-2026-45585 is a security feature bypass vulnerability that can only be exploited if the attacker has physical access to a vulnerable device. It affects various Windows 11 and Windows Server 2025 versions.
The existence of the vulnerability was disclosed as a zero-day a week ago by a security researcher that goes by Nightmare Eclipse, ostensibly out of frustration with Microsoft’s handling of bug reports. The proof-of-concept (PoC) exploit published by them can be easily leveraged.
BitLocker’s core promise is that stolen or unattended machines will keep users’ data safe even if the drive is removed or the machine is powered off, because the data is encrypted at rest and the keys are tied to the Trusted Platform Module (TPM), which also verifies that the boot process hasn’t been tampered with before releasing the key.
“The vulnerability is not in the encryption itself, but in the recovery environment that surrounds BitLocker,” NCSC Netherlands pointed out.
Vulnerability analyst Will Dormann confirmed that the PoC exploit works.
Mitigations available
Microsoft’s proffered mitigations involve either:
- Removing a vulnerable value (autofstx.exe) from the mounted Windows Recovery Environment (Windows RE) image hive and reestablishing BitLocker trust for WinRE, or
- Adding a PIN to the BitLocker protection
Dormann noted that the first option works because the FsTx Auto Recovery Utility (autofstx.exe) is prevented from automatically starting when the WinRE image launches.
The second, easier to implement option works as well, though Nightmare Eclipse previously stated they are holding back a PoC exploit that can bypass TPM+PIN protection.
They previously published PoC for several Microsoft zero-days, including:
- BlueHammer (a Windows local privilege escalation vulnerability),
- RedSun (another Windows privilege escalation flaw), and
- UnDefend (a vulnerability that can be exploited to block Microsoft Defender from receiving signature updates or disable it).
UPDATE (May 21, 2026, 06:40 a.m. ET):
Microsoft has updated the initial advisory to include a script admins can run to implement the first mitigation.
“[The script] works by mounting the WinRE image, editing its offline SYSTEM registry to remove the entry if present, then safely committing changes and re‑sealing WinRE so BitLocker trust remains intact,” the company explained.
“It’s designed to be safe—if the autofstx.exe entry isn’t there, it exits without making changes.”
UPDATE (June 10, 2026, 10:15 a.m. ET):
Microsoft has released a fix for CVE-2026-45585.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/05/20/yellowkey-bitlocker-mitigation-cve-2026-45585/