This vulnerability is a command injection flaw in Microsoft Windows 11 Version 24H2 (build 10.0.26100.0) that allows improper neutralization of special elements used in commands, leading to a security feature bypass referred to as "YellowKey." Microsoft has publicly acknowledged the issue and released mitigation guidance as a workaround. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity with potential high impact on confidentiality, integrity, and availability. The vendor advisory confirms no official patch is yet available, but mitigations can be applied without affecting service availability. Use of TPM+PIN protects against exploitation.

Successful exploitation could lead to compromise of confidentiality, integrity, and availability of affected systems. The vulnerability allows bypassing a security feature, potentially enabling unauthorized command execution. However, exploitation requires local access (AV:P) and no user interaction is needed. Systems using TPM+PIN are not vulnerable. No known exploits are reported in the wild at this time.

Microsoft recommends implementing the provided mitigation guidance as a temporary workaround until a security update is released. These mitigations do not affect service availability or management operations. Users employing TPM+PIN are not at risk from this vulnerability. Once the official security update is available, it will maintain the mitigation behavior, so no reversion of changes is necessary. Monitor the Microsoft Security Response Center advisory for updates.