YellowKey BitLocker bypass and GreenPlasma Windows LPE disclosed publicly

An anonymous researcher using the aliases Nightmare-Eclipse and Chaotic Eclipse publicly released details for two alleged Microsoft zero-days, YellowKey and GreenPlasma, adding to a string of earlier disclosures that included BlueHammer, RedSun, and UnDefend. YellowKey is described as a BitLocker bypass that requires physical access and a USB device, allowing an attacker to reboot into the Windows Recovery Environment (WinRE) and gain access to an encrypted drive; reporting said the technique was independently reproduced. Public materials claim the issue affects Windows 11 and Windows Server 2022/2025, while Windows 10 is not affected.

GreenPlasma was disclosed as a local privilege escalation flaw that allegedly abuses CTFMon and Windows Object Manager section handling to obtain SYSTEM privileges, although reports said the released code still triggers a UAC prompt under default settings. Security experts warned that YellowKey could sharply raise the impact of laptop theft because BitLocker is often the final safeguard for stolen Windows devices; suggested mitigations include enabling a BitLocker PIN and locking firmware settings with a BIOS password, while no practical workaround for GreenPlasma was identified beyond a future vendor patch. Microsoft had not publicly responded to the two disclosures at the time of reporting, and prior proof-of-concept releases from the same researcher were reportedly later used in real-world attacks.