YellowKey and GreenPlasma Zero-Days Target BitLocker Encryption and Windows Privilege Escalation

The anonymous researcher known as Chaotic Eclipse has released two critical Windows zero-day vulnerabilities that compromise BitLocker encryption and enable privilege escalation to SYSTEM level. Designated YellowKey and GreenPlasma, these exploits join three previously disclosed Microsoft Defender vulnerabilities (BlueHammer, RedSun, and UnDefend) that the researcher published in April 2026 following alleged frustrations with Microsoft's vulnerability disclosure process. At least one of those earlier vulnerabilities is now actively exploited in the wild.

YellowKey: BitLocker Bypass Through Windows Recovery Environment

YellowKey represents a fundamental weakness in Windows Recovery Environment (WinRE) that functions effectively as a backdoor to BitLocker-protected systems. The vulnerability affects Windows 11 and Windows Server 2022/2025, allowing attackers with physical access to bypass BitLocker encryption regardless of TPM or TPM+PIN configurations.

The attack vector involves placing specially crafted FsTx (Transactional NTFS) files on either a USB drive or the EFI partition. When the USB drive is connected to a BitLocker-protected target system and the machine is rebooted into WinRE, holding the CTRL key triggers a command shell with full access to the decrypted volume. Security researcher Will Dormann independently reproduced the exploit and identified the core issue: Transactional NTFS components on one volume can delete the winpeshl.ini file on another drive (X:), resulting in cmd.exe execution instead of the expected Windows Recovery Environment interface.

GreenPlasma: CTFMON Privilege Escalation to SYSTEM

The second vulnerability exploits Windows Collaborative Translation Framework (CTFMON) through arbitrary section creation. While the released proof-of-concept is incomplete and lacks the full code necessary for obtaining a SYSTEM shell, it demonstrates a viable privilege escalation path. The exploit allows unprivileged users to create arbitrary memory section objects within directory objects that are writable by SYSTEM. This enables potential manipulation of privileged services or drivers that implicitly trust those paths—locations that standard users normally cannot write to.

Escalating Tensions with Microsoft

Chaotic Eclipse's disclosure follows a contentious month after releasing three Microsoft Defender zero-days in April 2026. The researcher cited dissatisfaction with Microsoft's vulnerability handling process as motivation for public disclosure. While Microsoft assigned CVE-2026-33825 to BlueHammer and issued a patch, the researcher claims Microsoft silently fixed RedSun without public advisory or acknowledgment. All three vulnerabilities are now under active exploitation.

The researcher's statement directly challenges Microsoft: "I hope you at least attempt to resolve the situation responsibly, I'm not sure what type of reaction you expected from me when you threw more gas on the fire after BlueHammer. The fire will go as long as you want, unless you extinguish it or until there nothing left to burn." Chaotic Eclipse has promised a "big surprise" timed to coincide with Microsoft's June 2026 Patch Tuesday.

Related BitLocker Downgrade Attack

French cybersecurity firm Intrinsec disclosed a separate BitLocker attack chain that exploits CVE-2025-48804 (CVSS 6.8) to bypass encryption on fully patched Windows 11 systems in under five minutes. The attack leverages boot manager downgrade by manipulating System Deployment Image (SDI) files. When a second WIM is added to the SDI with a modified blob table, the boot manager verifies the first legitimate WIM while booting from the attacker-controlled second WIM containing an infected WinRE image that executes cmd.exe with the decrypted BitLocker volume accessible.

Although Microsoft patched CVE-2025-48804 in July 2025, the fundamental problem persists: Secure Boot only verifies a binary's signing certificate, not its version. Attackers can use vulnerable versions of bootmgfw.efi signed with the trusted PCA 2011 certificate to circumvent BitLocker protections. Microsoft plans to retire the PCA 2011 certificates in June 2026, but until revocation occurs, vulnerable boot managers remain exploitable.

Immediate Mitigation Measures

While Microsoft has not yet patched YellowKey or GreenPlasma, organizations can implement defensive measures to reduce exposure:

• Enable BitLocker PIN at startup for preboot authentication—though YellowKey reportedly bypasses TPM+PIN protection, this adds defense-in-depth layers
• Implement physical security controls to prevent unauthorized USB device access and physical machine access
• Monitor for unauthorized WinRE boot attempts and USB device connections
• Migrate boot manager to CA 2023 certificate and revoke legacy PCA 2011 certificates ahead of Microsoft's June 2026 retirement date
• Restrict physical access to servers and workstations containing sensitive data
• Review and harden Windows Recovery Environment access policies
• Apply available patches for CVE-2025-48804 and related boot manager vulnerabilities

Assessment

The YellowKey and GreenPlasma disclosures represent serious design-level vulnerabilities in core Windows security components. YellowKey's ability to bypass BitLocker regardless of TPM+PIN configuration fundamentally undermines the encryption protection that enterprises rely on for data-at-rest security. The cross-volume modification capability identified by Dormann suggests architectural issues that may spawn additional vulnerabilities.

The escalating disclosure pattern from Chaotic Eclipse indicates a breakdown in coordinated vulnerability disclosure processes. With active exploitation already occurring for the earlier Defender vulnerabilities and promises of additional disclosures targeting June Patch Tuesday, security teams should prepare for continued Windows zero-day activity. Organizations must prioritize physical security controls as a critical defense layer, as both YellowKey and the Intrinsec BitLocker downgrade attack require physical access. The compressed timeline between disclosure and active exploitation—exemplified by the April Defender vulnerabilities—demands immediate attention to mitigation measures rather than waiting for official patches.