Overview
- Microsoft began tracking the flaw as CVE-2026-45585 and published mitigation guidance after a researcher publicly released a proof-of-concept for the YellowKey exploit, which surfaced in mid-May.
- The exploit uses specially crafted FsTx files and the WinRE-only utility autofstx.exe to trigger a Transactional NTFS replay that deletes winpeshl.ini and yields an unlocked command shell against BitLocker-protected volumes.
- Microsoft’s recommended fixes are to remove the autofstx.exe entry from the WinRE image’s Session Manager BootExecute value and to convert devices from TPM-only BitLocker to TPM+PIN to require a pre-boot PIN.
- YellowKey requires physical access (for example a USB or EFI payload) and affects Windows 11 (x64 24H2, 25H2, 26H1) and Windows Server 2025 builds, so administrators must weigh the risk to laptops and unattended devices.
- A disputed claim from the researcher that a variant can bypass TPM+PIN remains unproven, and the public PoC plus non-trivial remediation steps mean teams should harden physical controls and apply Microsoft’s mitigations until a patch is released.