Critical BitLocker Flaw Lets Attackers Access Encrypted Windows Drives

Key Takeaways

• Two unpatched zero-day vulnerabilities, “YellowKey” and “GreenPlasma,” have been publicly disclosed, impacting Microsoft Windows.
• YellowKey allows a complete bypass of BitLocker encryption on specific Windows versions, enabling unauthorized access to encrypted drives.
• GreenPlasma is a local privilege escalation flaw that could allow attackers to execute arbitrary commands with elevated privileges.
• The exploits were released by a frustrated researcher following Microsoft’s Patch Tuesday, reportedly due to dissatisfaction with previous vulnerability handling.
• No official patch is available from Microsoft, leaving millions of enterprise and government devices vulnerable.

Two critical, unpatched zero-day vulnerabilities affecting Microsoft’s Windows ecosystem have been publicly disclosed, posing a significant threat to encrypted data and system integrity. These exploits, dubbed “YellowKey” and “GreenPlasma,” bypass BitLocker encryption and enable privilege escalation, respectively.

The disclosures come from a researcher who, following Microsoft’s recent Patch Tuesday, escalated an ongoing dispute by releasing the severe exploits. The researcher expressed profound dissatisfaction with how Microsoft handled prior vulnerability disclosures, releasing the code as a direct act of retaliation and threatening further disruptions.

Millions of enterprise and government devices are now vulnerable due to this unexpected release. The researcher also controversially claims these vulnerabilities are “intentionally placed backdoors,” even attributing them to internal Microsoft threat groups like MSTIC and GHOST in an unusual public statement.

YellowKey BitLocker Bypass

YellowKey represents a critical bypass that allows threat actors with physical access to completely circumvent BitLocker full-disk encryption in a matter of minutes. This vulnerability is rooted in the Windows Recovery Environment (WinRE) and specifically affects Windows 11, Windows Server 2022, and Windows Server 2025.

Windows 10 installations remain unaffected due to fundamental differences in its recovery architecture. To execute the exploit, attackers only need to copy a specially named FsTx folder onto a compatible USB stick and insert it into the target machine.

Alternatively, attackers can physically remove the target drive, copy the exploit files directly into the EFI partition, and then remount the drive to achieve the same bypass. By rebooting the system into the recovery agent using specific key combinations, the exploit leverages WinRE components to spawn a shell, granting unrestricted access to the protected volume.

GreenPlasma Privilege Escalation

In addition to the BitLocker bypass, the researcher also released partial proof-of-concept code for GreenPlasma, a severe local privilege escalation vulnerability. This flaw specifically exploits the Windows CTFMON service through the arbitrary creation of memory sections.

An attacker operating with unprivileged access can create these memory-section objects within directory structures typically writable only by the administrative SYSTEM account. This manipulation allows malicious actors to coerce trusted Windows services and kernel-mode drivers into executing unauthorized commands.

While the publicly available code currently triggers a User Account Control prompt and would require further development for a completely silent attack, it nonetheless presents a substantial challenge for security defenders. If fully chained with initial access vectors, GreenPlasma could provide persistent, full access to the core of the operating system.

What You Should Do

• Implement Strong BitLocker PINs and BIOS Passwords: While the public PoC doesn’t yet bypass TPM and PINs, a custom BitLocker PIN combined with a robust BIOS password can add layers of defense against YellowKey.
• Restrict Physical Access: Maintain strict physical security controls over all affected Windows 11 and Server 2022/2025 endpoints to prevent attackers from inserting USB devices or directly manipulating drives.
• Monitor WinRE Modifications: Actively monitor and restrict unauthorized modifications to the Windows Recovery Environment (WinRE) until official patches are released.
• Stay Informed: Monitor official Microsoft channels for security advisories and patches related to these vulnerabilities.
• Review Least Privilege Principles: Ensure that all users and applications operate with the absolute minimum necessary privileges to mitigate the impact of privilege escalation vulnerabilities like GreenPlasma.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.