Microsoft has identified a security feature bypass vulnerability in Windows, colloquially known as "YellowKey", for which a public proof-of-concept is available. The flaw permits an attacker to sidestep BitLocker’s security safeguards if the victim uses the default encryption method rather than a TPM + PIN configuration. During a local or elevated-privilege session, the attacker can leverage YellowKey to retrieve or use the BitLocker recovery key, thereby compromising encrypted data. The weakness falls under CWE‑77 – indicating an improper validation of a user-supplied expression that may lead to command injections or skipping of integrity checks. As a result, unauthorized users could gain read or alter access to a protected volume without needing the standard authentication mechanism.

The vulnerability affects Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025, including the Server Core installation. All affected builds are identified by the corresponding CPE entries for Windows 11 and Windows Server 2025.

The CVSS score of 6.8 places the vulnerability in the moderate severity range, and the EPSS score is < 1% (0.00106), indicating a very low but non‑zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the publicly released proof of concept, the attack vector appears to be local or requires elevated privileges, but this inference is not confirmed in the official description.