Summary Points
- Attackers with physical access can exploit the YellowKey vulnerability to bypass BitLocker encryption by placing crafted files on USB or EFI, triggering unrestricted shell access during reboot.
- Successful exploitation allows the attacker to sidestep device encryption and access encrypted data with elevated privileges.
- Mitigation involves disabling auto-start of the FsTx utility in WinRE, switching to TPM+PIN mode, or requiring additional startup authentication, to prevent unauthorized access.
The Threat, Attack Techniques, and Targets
Microsoft revealed a new vulnerability called YellowKey, which affects certain Windows systems. The flaw allows attackers to bypass a security feature called BitLocker. The CVE number for this flaw is CVE-2026-45585, and its severity score is 6.8 out of 10. The vulnerability was publicly disclosed last week and is considered a zero-day flaw.
Cybercriminals can exploit YellowKey using a special type of file called ‘FsTx’. They place this file on a USB drive or EFI partition. When the USB is connected to a Windows computer with BitLocker enabled, and the system is rebooted into Windows Recovery Environment (WinRE), the attacker can trigger a shell with full access. This process involves holding the CTRL key during startup to gain unrestricted access to the encrypted data.
The vulnerability mainly impacts Windows 11 versions 26H1, 24H2, 25H2, as well as Windows Server 2025 and its server core installation. Physical access to the device is required for the attack to succeed.
Impact, Security Implications, and Remediation Guidance
The YellowKey flaw could allow an attacker with physical access to bypass BitLocker’s protection. If exploited, this can lead to unauthorized access to sensitive data stored on the device. This impacts organizations that rely on BitLocker encryption for data security.
Microsoft released a mitigation plan to address this vulnerability. To reduce the risk, users should follow these steps:
– Mount the WinRE image on each device.
– Open the system registry hive within the WinRE image.
– Remove the “autofstx.exe” entry from the BootExecute registry key.
– Save and close the registry file.
– Update the WinRE image.
– Re-enable BitLocker on the system.
Additionally, Microsoft recommends changing the BitLocker protection method from TPM-only to TPM+PIN. This requires users to input a PIN during startup, adding an extra layer of security. For devices that are not encrypted, administrators should enable the “Require additional authentication at startup” option via Group Policies or Microsoft Intune.
Since detailed remediation steps are not included directly in the report, affected organizations are advised to consult official guidance from Microsoft or their security authorities for precise instructions.
Continue Your Tech Journey
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
