By Guru Baran
Publication Date: 2026-05-20 09:25:00
Microsoft has disclosed a critical zero-day vulnerability in Windows BitLocker, tracked as CVE-2026-45585, that allows threat actors with physical access to bypass full-disk encryption entirely, potentially exposing sensitive data within minutes.
The flaw was publicly disclosed on May 19, 2026, and while no active exploitation has been confirmed, Microsoft rates it as “Exploitation More Likely,” prompting urgent mitigation action.
The vulnerability is classified as a Security Feature Bypass with a maximum severity rating of Important.
It resides within the Windows Recovery Environment (WinRE) and is tied to a critical exploit chain dubbed YellowKey, developed by researcher Nightmare-Eclipse and published on GitHub.
A successful attacker can exploit this flaw to circumvent BitLocker Device Encryption on the system storage device, gaining unauthorized access to encrypted data without requiring user credentials or decryption keys.
The vulnerability exclusively…
