Zero-day exploit completely defeats default Windows 11 BitLocker protections

A newly discovered zero-day exploit has emerged, enabling individuals with physical access to a Windows 11 device to circumvent the standard BitLocker security measures and gain immediate access to encrypted data. This vulnerability, dubbed YellowKey, was unveiled earlier this week by a researcher known as Nightmare-Eclipse. YellowKey effectively bypasses the built-in BitLocker encryption, which Microsoft employs to safeguard disk contents from unauthorized access. This protection is crucial for many businesses, especially those that work closely with government entities. The exploit relies on a specially crafted FsTx folder, though detailed information on this folder is scarce. The exploit leverages a feature called transactional NTFS, which allows developers to perform file operations within transactions. Users can initiate the bypass using straightforward steps: they can either hold the [Shift] key while clicking the power icon to restart or quickly reboot the device as soon as Windows begins to load. This process opens a command prompt that grants full access to the drive, allowing attackers to manipulate the data at will—copying, altering, or deleting files without needing the BitLocker recovery key. Security experts such as Kevin Beaumont and Will Dormann have validated the existence of the YellowKey exploit, confirming its functionality. The exact mechanism through which the FsTx folder facilitates this bypass remains unclear; however, it appears to be linked to the underlying workings of Transactional NTFS. Dormann noted that inspecting the Windows fstx.dll reveals code that interacts with the FsTx folder, suggesting a potential vulnerability in the system’s architecture.