PT-2026-42025 · Microsoft · Windows

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-45585

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description A security feature bypass known as YellowKey allows attackers with physical access to access encrypted data via the Windows Recovery Environment (WinRE).

Recommendations Switch TPM-only BitLocker to TPM+PIN. Remove autofstx.exe from WinRE BootExecute.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-45585

Affected Products

Windows

References · 26

• 🔥 https://github.com/Nightmare-Eclipse/YellowKey · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45585 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585 · Vendor Advisory
• https://twitter.com/TheHackersNews/status/2057021006527832392 · Twitter Post
• https://twitter.com/molari999/status/2057036430216487088 · Twitter Post
• https://t.me/RNetsec/23163 · Telegram Post
• https://twitter.com/CVEnew/status/2056994212374282281 · Twitter Post
• https://t.me/defcon_news/135829 · Telegram Post
• https://t.me/thehackernews/9043 · Telegram Post
• https://twitter.com/battista212/status/2057039670454669497 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1tintba/microsoft_addresses_yellowkey_bitlocker_bypass · Reddit Post
• https://twitter.com/TheCyberSecHub/status/2057038775008829592 · Twitter Post
• https://twitter.com/shah_sheikh/status/2057036012120113230 · Twitter Post
• https://t.me/defcon_news/135819 · Telegram Post
• https://twitter.com/DFIR_Radar/status/2057024467331903947 · Twitter Post