Loading vulnerability…
CVE-2026-45585, publicly referred to as YellowKey, is a Windows BitLocker security feature bypass vulnerability affecting some versions of the Windows Recovery Environment. Public reporting describes the issue as enabling an attacker with physical access to a device to bypass BitLocker protection by abusing WinRE-based recovery or boot flows on systems that rely on TPM-only disk unlock. Multiple reports characterize the flaw as stemming from improper handling of special characters used in system commands, while more detailed technical reporting ties exploitation to WinRE behavior that can be abused to obtain access to an unlocked BitLocker-protected volume. The vulnerability does not break BitLocker cryptography directly; instead, it bypasses the intended pre-boot protection model and allows access to encrypted data through the recovery environment. Systems configured with TPM+PIN are reported as not exploitable via this issue.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (38 hidden).
This repository is a Windows C++ utility named YellowKey that presents itself as a BitLocker recovery key extractor and CVE-2026-45585 bypass assessment tool. It is not a remote exploit; it is a local/physical-access post-compromise or audit-style tool focused on BitLocker-protected systems. The core capability is sensitive: it enumerates BitLocker volumes via WMI, invokes manage-bde to retrieve protector details and parse numerical recovery passwords, tests whether a drive uses a TPM-only protector set, inspects TPM presence/status through TBS APIs, verifies installed KB patches, and exports audit reports that may contain full recovery keys. Repository structure is organized into config/, docs/, include/, modules/, and src/. The config directory contains CLI syntax, CVE metadata, protector heuristics, report templates, and runtime settings. The docs directory provides installation, remediation, troubleshooting, and CVE background. The include directory defines interfaces for BitLocker, TPM, parsing, reporting, and app control. The src directory contains the main entry point and implementations for BitLocker API access, CLI handling, GUI, key parsing, reporting, and TPM interaction. The modules directory adds operational features such as bypass testing, event logging, patch verification, remediation guidance, silent export, and volume management. Main execution starts in src/main.cpp, which selects GUI or CLI mode based on --cli. CLI commands include scan, extract, bypass-test, tpm-status, export, and remediation. The most important code paths are BitLockerAPI::EnumerateVolumes() using WMI namespace ROOT\\CIMV2\\Security\\MicrosoftVolumeEncryption and query SELECT * FROM Win32_EncryptableVolume; BitLockerAPI::GetRecoveryKey() and GetProtectorTypes() invoking manage-bde -protectors -get; KeyParser routines extracting numerical passwords and protector types; BypassTester logic marking TPM-without-PIN/StartupKey as vulnerable; and VolumeManager::UnlockVolume() invoking manage-bde -unlock with a recovery password. From an exploit-intelligence perspective, the repository’s practical capability is recovery-key disclosure and local BitLocker access assistance rather than a full autonomous exploit chain. It can expose or export recovery keys, determine whether a host is configured in a supposedly vulnerable way, and use a provided recovery key to unlock a volume. The code contains several implementation inconsistencies and simplifications, but the intent and offensive utility are clear enough to classify it as an operational local BitLocker key extraction/audit tool rather than a mere detector.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
114 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously disclosed Windows/BitLocker-related vulnerability referenced only in passing among earlier exploit publications.
A BitLocker bypass vulnerability referenced as one of NightmareEclipse’s earlier releases.
A previously disclosed BitLocker bypass vulnerability, referred to as YellowKey, mentioned as a comparison point for the current BitLocker bypass issue.
Another Microsoft-related zero-day mentioned only in passing in a list of disclosed bugs; no technical details are provided in this article.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.