{"id":983,"date":"2026-05-20T09:47:10","date_gmt":"2026-05-20T09:47:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=983"},"modified":"2026-05-20T09:47:10","modified_gmt":"2026-05-20T09:47:10","slug":"microsoft-releases-mitigation-for-yellowkey-bitlocker-bypass-cve-2026-45585-exploit","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=983","title":{"rendered":"Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 20, 2026<\/span><\/span>Vulnerability \/ Encryption<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft on Tuesday released a mitigation for a BitLocker bypass vulnerability named YellowKey following its public disclosure last week.<\/p>\n

The zero-day flaw, now tracked as CVE-2026-45585<\/b>, carries a CVSS score of 6.8. It has been described as a BitLocker security feature bypass.<\/p>\n

\u00abMicrosoft is aware of a security feature bypass vulnerability in Windows publicly referred to as ‘YellowKey,'\u00bb the tech giant said<\/a> in an advisory. \u00abThe proof of concept for this vulnerability has been made public, violating coordinated vulnerability best practices.\u00bb<\/p>\n

The issue impacts Windows 11 version 26H1 for x64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows Server 2025, and Windows Server 2025 (Server Core installation).<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

YellowKey was disclosed by a security researcher named Chaotic Eclipse (aka Nightmare-Eclipse). It essentially allows placing specially crafted ‘FsTx’ files on a USB drive or EFI partition, plugging the USB drive into the target Windows computer with BitLocker protections turned on, rebooting into the Windows Recovery Environment (WinRE), and triggering a shell with unrestricted access by holding down the CTRL key.<\/p>\n

\u00abIf you did everything properly, a shell will spawn with unrestricted access to the BitLocker protected volume,\u00bb the researcher noted in a GitHub post.<\/p>\n

Redmond noted that successful exploitation could permit an attacker with physical access to sidestep the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data.<\/p>\n

To address the risk, the following mitigations have been outlined:<\/p>\n