This vulnerability involves improper neutralization of special elements used in a command, allowing potential command injection on Windows 11 Version 24H2 (build 10.0.26100.0). Microsoft acknowledges the issue and has issued a CVE to provide mitigation guidance until an official security update is available. The vulnerability is known as "YellowKey" and a proof of concept has been publicly disclosed. Microsoft recommends applying the provided mitigations, which do not affect service availability or management operations. Systems using TPM+PIN are not exploitable. No official patch is currently available; the remediation level is classified as a workaround.

Exploitation of this vulnerability could lead to full confidentiality, integrity, and availability impact on affected systems, as indicated by the CVSS vector (C:H/I:H/A:H). However, exploitation requires local access (AV:P) and no privileges (PR:N) or user interaction (UI:N) are needed. The vulnerability could allow attackers to bypass security features and execute arbitrary commands, potentially compromising devices and data.

Microsoft currently recommends implementing the provided temporary mitigations to protect devices until a security update is released. These mitigations do not impact service availability or management operations. Users employing TPM+PIN are not at risk from this vulnerability. Once the official security update is available, it will maintain the mitigation behavior, so reverting changes is not necessary. Patch status is not yet confirmed — check the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585 for current remediation guidance.