Windows BitLocker 0-Day Vulnerability Exposes Encrypted Drives to Unauthorized Access

YellowKey is a publicly disclosed Windows zero-day that can bypass BitLocker by exploiting a weakness in the Windows Recovery Environment (WinRE). The attack, demonstrated against Windows 11 and recent server editions, uses specially crafted files on USB media or the EFI system partition to cause WinRE to replay NTFS transaction logs and open a shell with access to BitLocker-protected volumes; the disclosure includes public proof-of-concept materials and a related flaw called GreenPlasma. Organizations using affected platforms should assume physical-access threats, review BitLocker protector settings and WinRE exposure, and apply any vendor guidance when available.