Windows BitLocker Security Feature Bypass Vulnerability

CVE	CVE-2026-45585
State	PUBLISHED
Assigner	microsoft
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-05-20 00:16:44 UTC
Updated	2026-05-20 16:42:42 UTC
Description	Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable.

Primary CVSS: v3.1 6.8 MEDIUM from [email protected]

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001130000 probability, percentile 0.295970000 (date 2026-05-28)

Problem Types: CWE-77 | CWE-77 CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	6.8	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	CVSS	6.8	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C`

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Microsoft	Windows 11 24h2	All	All	All	All
Operating System	Microsoft	Windows 11 25h2	All	All	All	All
Operating System	Microsoft	Windows 11 26h1	All	All	All	All
Operating System	Microsoft	Windows Server 2025	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Microsoft	Windows 11 Version 24H2	affected -	x64-based Systems
CNA	Microsoft	Windows 11 Version 25H2	affected -	x64-based Systems
CNA	Microsoft	Windows 11 Version 26H1	affected -	x64-based Systems
CNA	Microsoft	Windows Server 2025	affected -	x64-based Systems
CNA	Microsoft	Windows Server 2025 Server Core Installation	affected -	x64-based Systems

Reference	Source	Link	Tags
github.com/Nightmare-Eclipse/YellowKey	134c704f-9b21-4f2e-91b3-4a467353bcc0	github.com	Exploit, Third Party Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585	[email protected]	msrc.microsoft.com	Vendor Advisory, Mitigation
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.