YellowKey Zero-Day Bypasses BitLocker Encryption on Windows 11 and Server

A custom FsTx folder placed on a USB stick, combined with holding the Ctrl key while booting into the Windows Recovery Environment (WinRE), bypasses the BitLocker recovery key on default Windows 11 and Windows Server 2022/2025 deployments. The exploit opens a command prompt with the encrypted volume already decrypted by the TPM.

Ars TechnicaA new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoorWindows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege EscalationUSB stick opens Windows BitLocker drives in new zero-day

BitLocker stores its key in a TPM. WinRE can launch a command shell if its config file is missing. YellowKey uses Transactional NTFS (TxF) to delete that file via a malicious log on a USB drive.

Ars Technica

YellowKey was released by researcher Nightmare-Eclipse (aka Chaotic Eclipse). Independent verification was provided by Kevin Beaumont, Will Dormann of Tharros Labs, and KevTheHermit on X. Microsoft’s internal teams MORSE, MSTIC, GHOST and the Microsoft Security Response Centre (MSRC) are mentioned in the disclosures.

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor

Affected platforms: Windows 11, Windows Server 2022, Windows Server 2025. Unaffected: Windows 10. Exploit steps: copy the FsTx folder to a USB, insert it, reboot, hold Ctrl. Reproduced on Windows 11 build 10.0.26100.1. BitLocker is mandatory for many organizations, including government contractors.

Ars Technica

Microsoft stated, “We have a customer commitment to investigate reported security issues and update impacted devices to protect customers as soon as possible. We also support coordinated vulnerability disclosure.” No CVE has been assigned and Microsoft has not publicly acknowledged YellowKey.

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor

Nightmare-Eclipse claims the bug is an intentional backdoor, writing “huge thanks to MORSE, MSTIC and Microsoft GHOST for making this public disclosure possible.” The researcher also asserts “TPM+PIN does not help” and calls Microsoft’s response “childish.”

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor

Will Dormann observed that the FsTx log can delete winpeshl.ini on another volume, forcing WinRE to launch a command prompt with the BitLocker volume unlocked. KevTheHermit posted a successful PoC on X, confirming full access in seconds.

Ars Technica

The researcher says TPM+PIN does not mitigate, while Dormann suggested it might. The TxF root cause remains unknown, and Microsoft has not issued a patch. Why Windows 10 is unaffected is also unexplained.

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor

By defeating full-disk encryption, YellowKey exposes data on any device with physical access. Enterprises and agencies relying on BitLocker must reassess threat models and add physical safeguards until a fix is available.

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor

The researcher warned of a “big surprise” for Microsoft on the June 2026 Patch Tuesday. Analysts expect Microsoft may issue an out-of-band WinRE update, but no timeline has been confirmed.

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

• “one of the most insane discoveries I ever found,” — Chaotic Eclipse

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

• “Second thing is, no, TPM+PIN does not help, the issue is still exploitable regardless.” — Chaotic Eclipse

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

• “I think it will take a while even for MSRC to find the real root cause of the issue.” — Chaotic Eclipse

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

• “huge thanks to MORSE, MSTIC and Microsoft GHOST for making this public disclosure possible,” — Nightmare-Eclipse

A new Windows 11 BitLocker bypass only needs a USB stick, and the researcher thinks it's a backdoor