YellowKey BitLocker WinRE Security Feature Bypass
CVE-2026-45585, publicly referred to as YellowKey, is a Windows BitLocker security feature bypass affecting BitLocker-protected systems that rely on the Windows Recovery Environment (WinRE). Based on the provided content, the issue is rooted in WinRE behavior involving the FsTx Auto Recovery Utility (autofstx.exe), which automatically replays crafted NTFS transactional recovery data during recovery boot. An attacker with physical access can stage specially crafted FsTx files on removable media or in the EFI partition, boot or force the target into WinRE, and trigger replay that deletes winpeshl.ini. This causes WinRE to launch an unrestricted command shell instead of the normal restricted recovery interface. On TPM-only BitLocker configurations, the protected volume is already transparently unlocked by the TPM at that stage, allowing the attacker to interact with the decrypted system volume from the WinRE shell. The content indicates affected platforms include Windows 11 24H2, 25H2, and 26H1 on x64 systems and Windows Server 2025, with some reporting also referencing Windows Server 2022.
Impact, mitigation & remediation
What it means. What to do now. For analysts and engineers who need to decide and keep moving.
Impact
What an attacker gets — and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No valid public exploits — Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles against your asset inventory in the product.
Recent activity
49 sources tracked across advisories, community write-ups, and news. Mallory keeps watching after this page renders.
A Windows Recovery Environment (WinRE) BitLocker bypass that abuses NTFS transaction log replay via System Volume Information\FsTx to delete winpeshl.ini and obtain a command shell after TPM-based transparent unlock, enabling access to BitLocker-protected drives with physical access.
A BitLocker security feature bypass in Windows that allows an attacker with physical access to gain a shell with access to a BitLocker-protected volume by abusing the WinRE FsTx Auto Recovery Utility (autofstx.exe).
A Windows BitLocker security feature bypass vulnerability in WinRE that can allow an attacker with physical access to bypass BitLocker device encryption and access encrypted data without user credentials or decryption keys.
A BitLocker security feature bypass vulnerability in Windows that can allow an attacker with physical access to bypass BitLocker device encryption protections and access encrypted data.
A BitLocker security feature bypass vulnerability in Windows that allows attackers with physical access to bypass BitLocker protections and access data. The issue is described as affecting the recovery environment around BitLocker rather than the encryption itself.
A reported zero-day bypass of Windows BitLocker that abuses the Windows Recovery Environment and crafted FsTx recovery files on a USB stick to gain a SYSTEM shell and full volume access without password cracking or a TPM exploit.
See the full picture, correlated to your attack surface.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules — auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.