NewsPublished 20 May 2026

Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass

Source SecurityWeek

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-45585

Description

The exploitation is mitigated by preventing the FsTx Auto Recovery Utility from starting when the WinRE image launches. The post Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass appeared first on SecurityWeek .

Impact

An attacker with physical access can bypass BitLocker encryption on the system storage device by exploiting this vulnerability, gaining access to encrypted data without needing the encryption key. This compromises the confidentiality of data protected by BitLocker on affected systems. The exploit requires rebooting into recovery mode with a specially crafted USB drive. Systems relying solely on TPM protection or TPM+PIN may be affected, though adding a PIN is recommended. There are no known exploits in the wild at this time.

Defensive guidance

Microsoft has released official mitigations that prevent the FsTx Auto Recovery Utility from running during the WinRE image launch. Defenders should follow Microsoft's multi-stage process to mount the WinRE image, remove autofstx.exe, and reestablish BitLocker trust. Additionally, enabling a BitLocker PIN is recommended to add an extra layer of protection, though it may not fully prevent exploitation. Since this is not a cloud service, patch status is based on Microsoft's advisory, which confirms mitigations are available. Organizations should apply these mitigations promptly to prevent exploitation.

Summary

YellowKey (CVE-2026-45585) is a physical access exploit that bypasses BitLocker encryption by manipulating the Windows Recovery Environment. It leverages the FsTx Auto Recovery Utility (autofstx.exe) triggered from a USB drive to delete the winpeshl.ini file, which controls WinRE behavior. This deletion causes WinRE to launch a command prompt instead of the recovery environment, exposing the encrypted system partition without BitLocker protection. Microsoft’s mitigation involves removing autofstx.exe from the WinRE image and reestablishing BitLocker trust, effectively preventing the exploit from running. The vulnerability affects systems using BitLocker with TPM-only or TPM+PIN configurations, though the latter may still be vulnerable. The exploit requires physical access and reboot into recovery mode. The underlying issue also suggests a potential vulnerability in Transactional NTFS replay capabilities.

References

securityweek.com/microsoft-rolls-out-mitigations-for-yellowkey-bitlocker-bypass/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 20 May 2026, 15:48 UTC

References

Community reviews

Related threats