BitLocker bypass raises Windows recovery risks

Microsoft’s BitLocker encryption faces renewed scrutiny after a public proof-of-concept exploit showed how protected Windows drives could be accessed through the recovery environment without the recovery key under specific physical-access conditions.

The vulnerability, named YellowKey by the researcher using the aliases Nightmare-Eclipse and Chaotic Eclipse, targets the interaction between Windows Recovery Environment and BitLocker-protected volumes. The public demonstration indicates that an attacker with physical access to a device may be able to use a prepared USB drive and boot into recovery mode to gain command-line access to the encrypted system volume after it has been unlocked by Windows.

The disclosure has prompted concern among enterprise security teams because BitLocker is widely used to protect laptops, workstations and servers against data exposure when devices are lost, stolen or seized. The threat model is especially important for organisations handling regulated data, confidential commercial information, legal documents, financial records or government material.

YellowKey is reported to affect Windows 11 and Windows Server 2022 and 2025. Windows 10 does not appear to be affected by the public scenario described so far. The exploit requires physical possession or close access to the target machine, limiting its usefulness for remote attackers but increasing its relevance in theft, insider-risk, border-search and device-repair scenarios.

The issue centres on Windows Recovery Environment, known as WinRE, which is designed to help repair a damaged installation, restore systems and recover from boot failures. During the exploit path described by researchers, crafted files placed on removable media are processed in a way that can influence recovery operations. Security analysts have pointed to Windows file-system transaction mechanisms as a likely factor, raising questions over how recovery components handle data across volumes during repair workflows.

The researcher’s materials suggest that the attack can be triggered by copying a specific directory structure to a USB stick, inserting it into the target device and entering the recovery environment during reboot. Once the chain succeeds, the attacker may obtain a shell with access to the unlocked BitLocker volume. That would undermine the central purpose of full-disk encryption, which is to keep data inaccessible without a trusted boot path, user authentication or a recovery key.

Microsoft had not issued a public patch specifically identifying YellowKey at the time the exploit attracted attention. No dedicated CVE identifier was clearly attached to the disclosure in the public material available by 14 May 2026. Security teams are therefore treating the issue as an unpatched vulnerability while awaiting formal guidance, update notes or mitigation steps from Microsoft.

The researcher also disclosed GreenPlasma, a separate Windows local privilege-escalation issue said to affect Windows 11 and Windows Server 2022 and 2025. GreenPlasma is less central to the BitLocker concern but adds to unease over a sequence of Windows flaws released by the same researcher after disputes over vulnerability handling. Earlier tools attributed to the same alias, including BlueHammer, RedSun and UnDefend, were linked to Windows Defender weaknesses and drew attention after signs of use in live intrusions.

Security specialists are urging organisations not to view BitLocker as broken in every deployment, but to review configurations that depend only on unattended TPM-based unlocking. BitLocker often operates transparently with the Trusted Platform Module, allowing a device to boot without a user-entered PIN. That design improves usability, but it can leave stolen devices more exposed when an attacker can manipulate the recovery or boot environment.

A stronger configuration uses TPM plus a pre-boot PIN, requiring a user-supplied secret before the drive is unlocked. Some analysts believe that such a setting may reduce exposure to the public YellowKey path, although claims around possible variants have led to caution. Enterprises are also advised to restrict booting from external media, lock down firmware settings, enable Secure Boot, protect UEFI configuration with administrative passwords and ensure recovery partitions are updated when Microsoft ships fixes.

Fleet managers face a practical challenge because BitLocker settings vary widely across organisations. Many companies enabled device encryption by default during Windows 11 rollouts, but not all enforced pre-boot authentication because of helpdesk overhead, remote-work friction and the risk of users forgetting PINs. The YellowKey disclosure is likely to revive internal debates about whether convenience-led encryption policies are sufficient for high-risk roles.