Loading vulnerability…
CVE-2023-24932 is a security feature bypass vulnerability in Windows Boot Manager exploited by the BlackLotus UEFI bootkit. An attacker with administrative rights or physical access can install an affected boot policy to bypass Secure Boot and execute untrusted software during startup. The vulnerability was used to bypass protections introduced for CVE-2022-21894. Microsoft initially addressed it in May 2023, with subsequent updates introducing additional boot-manager protections and revocations that require explicit activation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a Windows C++ utility named YellowKey that presents itself as a BitLocker recovery key extractor and CVE-2026-45585 bypass assessment tool. It is not a remote exploit; it is a local/physical-access post-compromise or audit-style tool focused on BitLocker-protected systems. The core capability is sensitive: it enumerates BitLocker volumes via WMI, invokes manage-bde to retrieve protector details and parse numerical recovery passwords, tests whether a drive uses a TPM-only protector set, inspects TPM presence/status through TBS APIs, verifies installed KB patches, and exports audit reports that may contain full recovery keys. Repository structure is organized into config/, docs/, include/, modules/, and src/. The config directory contains CLI syntax, CVE metadata, protector heuristics, report templates, and runtime settings. The docs directory provides installation, remediation, troubleshooting, and CVE background. The include directory defines interfaces for BitLocker, TPM, parsing, reporting, and app control. The src directory contains the main entry point and implementations for BitLocker API access, CLI handling, GUI, key parsing, reporting, and TPM interaction. The modules directory adds operational features such as bypass testing, event logging, patch verification, remediation guidance, silent export, and volume management. Main execution starts in src/main.cpp, which selects GUI or CLI mode based on --cli. CLI commands include scan, extract, bypass-test, tpm-status, export, and remediation. The most important code paths are BitLockerAPI::EnumerateVolumes() using WMI namespace ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption and query SELECT * FROM Win32_EncryptableVolume; BitLockerAPI::GetRecoveryKey() and GetProtectorTypes() invoking manage-bde -protectors -get; KeyParser routines extracting numerical passwords and protector types; BypassTester logic marking TPM-without-PIN/StartupKey as vulnerable; and VolumeManager::UnlockVolume() invoking manage-bde -unlock with a recovery password. From an exploit-intelligence perspective, the repository’s practical capability is recovery-key disclosure and local BitLocker access assistance rather than a full autonomous exploit chain. It can expose or export recovery keys, determine whether a host is configured in a supposedly vulnerable way, and use a provided recovery key to unlock a volume. The code contains several implementation inconsistencies and simplifications, but the intent and offensive utility are clear enough to classify it as an operational local BitLocker key extraction/audit tool rather than a mere detector.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A referenced possible UEFI Secure Boot-related bootkit component mentioned only as limited, unconfirmed evidence in connection with the SprySOCKS campaign.
A vulnerability in older Windows bootloaders that was exploited by the BlackLotus UEFI bootkit to bypass Secure Boot.
A Windows Secure Boot-related vulnerability that may be exploited by a UEFI bootkit component to maintain persistence even after a full OS reinstall, according to the report.
A Windows Boot Manager vulnerability associated with BlackLotus and potential UEFI bootkit persistence; in this content it is mentioned as a possible exploit path used to achieve persistence that could survive OS reinstalls.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.