YellowKey, tracked as CVE-2026-45585, demonstrated that an attacker with physical access could use specially prepared removable media and the Windows Recovery Environment to access data on certain BitLocker-protected systems. The vulnerability did not crack BitLocker’s encryption algorithm or recover a secret key through cryptanalysis. Instead, it abused a trusted recovery process after a TPM-only configuration had already allowed Windows to unlock the system volume, making YellowKey a security-boundary bypass rather than a conventional encryption break.
What YellowKey Actually Is
YellowKey is the public name given to a Windows BitLocker security-feature bypass disclosed in May 2026. Microsoft subsequently assigned it CVE-2026-45585 and rated it 6.8, or medium severity, under the CVSS 3.1 system. The rating reflects an attack that requires physical access but can have a serious effect on the confidentiality, integrity, and availability of data if successful.
The publicly demonstrated attack used specially constructed filesystem data on removable storage. When the target entered the Windows Recovery Environment, a Windows filesystem recovery component processed that data in a way that altered the expected recovery startup sequence. Instead of displaying the normal restricted recovery interface, the system could expose a privileged command shell while the protected operating-system volume was already accessible.
The important distinction is that the USB drive did not independently decrypt the disk. It influenced a trusted Windows recovery process that was operating in an environment where the TPM had already released the information needed to unlock the volume.
Why BitLocker Encryption Was Not Broken
Headlines describing BitLocker drives as being opened by placing a few files on a USB stick can create the impression that the encryption itself has been mathematically defeated. That is not what the public YellowKey demonstration established. There is no indication that the exploit calculated the BitLocker recovery key, derived the volume master key from encrypted data, or found a weakness in the underlying encryption algorithm.
BitLocker protects data through several connected components rather than through encryption alone. These components include the encrypted volume, the key protectors, the TPM, the boot process, Secure Boot measurements, Windows Recovery Environment behavior, and optional user authentication such as a startup PIN. A failure in any trusted component may expose decrypted data even when the encryption algorithm remains sound.
| Type of attack | What it targets | Does it break the encryption algorithm? |
|---|---|---|
| Cryptographic attack | The cipher, key length, or mathematical implementation | Potentially |
| Key extraction | A stored or transmitted encryption key | No, but it may reveal the key |
| YellowKey-style bypass | The trusted recovery and automatic-unlocking process | No |
| Windows login bypass | User authentication after the operating system starts | No |
Calling YellowKey only a Windows login-screen bypass is also incomplete. The exploit does not simply sign an attacker into an ordinary user account. It interferes with the recovery environment and may provide privileged access to a volume that Windows has already unlocked, allowing the attacker to work around both the expected recovery interface and normal account authentication.
How the Windows Recovery Environment Became the Attack Surface
The Windows Recovery Environment, commonly called WinRE, is a reduced Windows installation used for startup repair, system recovery, update recovery, troubleshooting, and device-reset operations. Because it must repair an operating system that may not boot normally, WinRE is trusted to perform powerful actions that would be inappropriate for an ordinary application.
Public technical analysis connected YellowKey to filesystem transaction recovery behavior. Windows can replay transaction information when repairing or recovering a filesystem, and the vulnerable path allowed information from attached storage to affect files used by the recovery environment. By changing the recovery startup behavior, the attack could replace the intended restricted interface with a command environment.
The TPM-only configuration was central to the demonstrated result. When the machine’s measured boot state appeared acceptable, the TPM could automatically release the material required to unlock the operating-system volume. The attacker then benefited from that legitimate unlocking process after redirecting what the trusted recovery environment did next.
A secure encryption design must protect not only the cipher and its keys, but also every trusted path that is permitted to request, receive, or use those keys. YellowKey exposed a weakness in that surrounding trust path.
Why Physical Access Still Matters
The public YellowKey attack requires physical control of the target computer. It is not a vulnerability that an anonymous internet user can normally exploit against a device sitting safely in a locked room. An attacker must be able to connect removable media and manipulate the device’s boot or recovery process.
Physical access does not make the issue irrelevant. Disk encryption is frequently enabled specifically to protect information when a laptop is lost, stolen, transported, repaired, or temporarily left outside its owner’s control. A bypass that works under those conditions challenges one of the main reasons organizations deploy full-disk encryption.
- Lost or stolen business laptops may contain confidential documents and cached credentials.
- Travel devices may be exposed in hotels, airports, vehicles, or inspection environments.
- Computers sent to third-party repair providers may leave the organization’s direct control.
- Shared offices and educational environments may provide opportunities for temporary physical access.
- High-value systems may face targeted attacks even when the technique cannot be used remotely.
The vulnerability therefore has different practical significance depending on the threat model. A stationary home desktop in a controlled room faces less exposure than a laptop carried by an executive, journalist, researcher, administrator, or employee with access to regulated information.
Affected Systems and Patch Status
Microsoft’s current vulnerability data identifies affected x64 editions of Windows 11 version 24H2, Windows 11 version 25H2, Windows 11 version 26H1, and Windows Server 2025. Earlier public reports described testing against a broader collection of Windows 11 and Windows Server installations, but Microsoft’s maintained affected-product list should be used when determining official exposure.
Windows 10 is not included in Microsoft’s affected-product list for CVE-2026-45585. Windows 11 version 23H2 is also absent from the current list. Administrators should nevertheless rely on the exact operating-system version and build number rather than assuming that every device marketed as Windows 11 has the same status.
Microsoft released the security update addressing YellowKey on June 9, 2026. For Windows 11 versions 24H2 and 25H2, the protection was included in KB5094126, which raised the corresponding builds to 26100.8655 and 26200.8655. Later cumulative updates also contain the fix because Windows security updates are cumulative.
| System category | Reported status | Recommended action |
|---|---|---|
| Windows 11 24H2 | Affected before the corrected build | Install the June 2026 security update or a later cumulative update |
| Windows 11 25H2 | Affected before the corrected build | Install the June 2026 security update or a later cumulative update |
| Windows 11 26H1 | Affected before the corrected build | Install the applicable June 2026 or later security update |
| Windows Server 2025 | Affected before the corrected build | Install the applicable server security update |
| Windows 10 | Not listed as affected | Continue normal security updating and BitLocker hardening |
The claim that YellowKey was merely scheduled to be fixed “next month” was accurate only during the period between its May disclosure and the June update. As of late June 2026, a security update is available. Devices that have not installed the applicable June update or a later cumulative release may remain exposed.
TPM-Only Versus TPM and PIN
Many Windows computers use BitLocker or Device Encryption with a TPM-only protector. This configuration is convenient because the system can start without asking the user for an additional pre-boot secret. The TPM releases the required material automatically when the measured boot state meets its policy.
Convenience also means that the TPM is making the primary decision about whether the disk should be unlocked. If an attacker can reach a trusted but vulnerable recovery path without invalidating the measurements expected by the TPM, the operating-system volume may become accessible before ordinary Windows login controls are relevant.
A TPM and startup PIN configuration introduces information that is not stored solely in the computer. Microsoft stated that the publicly documented CVE-2026-45585 attack is not exploitable when TPM and PIN protection is enabled. The required PIN prevents the volume from being automatically unlocked solely because the platform measurements appear valid.
| BitLocker configuration | Startup experience | YellowKey exposure before patching |
|---|---|---|
| TPM only | Normally starts without a pre-boot PIN | Exposed on affected unpatched systems |
| TPM and PIN | Requires a PIN before the volume is unlocked | Microsoft states the published vulnerability is not exploitable |
| Recovery key | Used when normal protectors cannot unlock the volume | Must be stored securely and separately from the device |
The researcher stated that a separate, unpublished method could also affect PIN-protected systems. An unpublished claim cannot be independently evaluated in the same way as released technical evidence. It should therefore be treated as an unverified assertion rather than proof that TPM and PIN protection has been defeated.
Why Windows 10 Was Not Listed as Vulnerable
YellowKey depends on specific behavior inside the recovery environment rather than on a universal property of BitLocker. Windows 10 and Windows 11 do not contain identical versions of every WinRE component, startup file, recovery utility, or filesystem-repair path. A technique that succeeds against a newer recovery implementation may therefore fail on an older one.
Public analysis indicates that the relevant filesystem transaction-recovery behavior operates differently in Windows 10. The vulnerable sequence used to influence the Windows 11 recovery startup process was not reproduced successfully on Windows 10, and Microsoft’s current CVE data does not classify Windows 10 as affected.
This difference does not mean Windows 10 possesses stronger disk encryption in every respect. It only means that this particular recovery-environment attack path was not established against Windows 10. Other BitLocker, bootloader, firmware, recovery, and physical-access vulnerabilities must be evaluated separately.
Does YellowKey Prove That BitLocker Has a Backdoor?
The public demonstration proves that a serious and surprisingly simple security bypass existed. It does not, by itself, prove that Microsoft intentionally created a secret access mechanism. Establishing a backdoor would require evidence of deliberate design intent, such as internal documentation, communications, source-code history, or another reliable record showing that the behavior was knowingly introduced for covert access.
Part of the suspicion arose because the vulnerable recovery behavior appeared unusually capable and because some filesystem changes could disappear when a transaction was rolled back. Transaction rollback, however, is designed to reverse incomplete filesystem operations. The disappearance of transaction-related evidence can therefore be explained by ordinary recovery semantics and is not independent proof of intentional concealment.
The vulnerability’s absence from Windows 10 also does not prove malicious intent. Windows components are routinely rewritten, replaced, or reorganized between operating-system generations. A regression, an unsafe trust assumption, insufficient validation, or an unexpected interaction between legitimate components can produce version-specific vulnerabilities without being an intentional backdoor.
YellowKey should be described as a confirmed BitLocker security-feature bypass and WinRE trust-boundary failure. Describing it as a proven Microsoft backdoor goes beyond the publicly established evidence.
The distinction matters because dramatic terminology can obscure the practical response. Regardless of how the flaw originated, affected systems required mitigation and patching. Investigating design intent may be important for accountability, but it does not replace installing the security update and reviewing the device’s BitLocker configuration.
How to Protect Windows Devices
The primary response is to install the applicable June 2026 Windows security update or any later cumulative update. Windows Update should normally deliver the correction automatically, but organizations should verify deployment through their endpoint-management or patch-compliance systems. A device should not be considered protected merely because updates were approved centrally.
- Check the Windows version, edition, build number, and most recent cumulative update.
- Restart the device when required so servicing and recovery-environment changes can finish.
- Confirm that update failures, paused updates, or insufficient recovery-partition space did not block installation.
- Review whether sensitive mobile systems should use TPM and a startup PIN.
- Store BitLocker recovery keys in an approved location that is separate from the protected computer.
- Restrict unauthorized boot and recovery access through firmware settings and physical controls.
- Maintain an inventory of laptops that travel, leave secure facilities, or contain high-value information.
Before the patch became available, Microsoft provided a temporary mitigation that prevented the relevant filesystem transaction auto-recovery utility from starting within WinRE. Microsoft indicated that devices did not need to reverse that mitigation after installing the security update because the corrected behavior maintains its protective effect. Manually changing WinRE should still be approached carefully because recovery environments can differ across installations and management platforms.
Disabling WinRE entirely can remove one recovery path, but it also eliminates useful repair and reset functions. It is generally less desirable than installing the official update. Organizations considering such a measure should test recovery, deployment, and support procedures rather than applying it to every device without preparation.
Users should also remember that Windows Hello, facial recognition, fingerprint login, and account passwords protect access at a different layer. They do not provide an additional BitLocker pre-boot secret when the disk is configured for TPM-only unlocking. A startup PIN is relevant because it is requested before the protected volume is released for normal use.
Final Assessment
YellowKey was a genuine security vulnerability with a publicly demonstrated proof of concept. On affected and unpatched systems, an attacker with physical access could manipulate the Windows Recovery Environment and reach data on a BitLocker-protected system volume. The technique was particularly relevant to TPM-only configurations commonly used for automatic Device Encryption and BitLocker startup.
The exploit did not demonstrate that AES encryption had been cracked, and it did not establish that every BitLocker configuration was universally defeated. Microsoft stated that TPM and PIN systems were not exploitable through the published vulnerability, while claims concerning an unreleased PIN bypass remain unverified.
There is also insufficient public evidence to conclude that YellowKey was an intentional backdoor. The more supportable interpretation is that a trusted recovery component processed attacker-controlled filesystem information in an unsafe way after the TPM had unlocked the disk. That was still a serious design and validation failure, particularly because protecting stolen computers is a central purpose of disk encryption.
As of June 2026, the practical conclusion is straightforward: install the June security update or a later cumulative update, verify that it completed successfully, and consider TPM and PIN protection for devices whose physical-loss risk justifies the additional startup step.
Tags
YellowKey, CVE-2026-45585, BitLocker bypass, Windows 11 security, Windows Recovery Environment, TPM startup PIN, full disk encryption, USB security exploit, BitLocker vulnerability
Post a Comment