Microsoft has publicly disclosed a security feature bypass known as "YellowKey" that can be demonstrated through a proof‑of‑concept. The flaw likely allows an attacker to gain unauthorized access to data protected by BitLocker encryption, effectively compromising the confidentiality of the encrypted volume. The identified weakness is classified as CWE‑77, indicating that the bypass may involve command injection or similar input validation failures that could enable arbitrary command execution to retrieve or manipulate encryption keys.

The vulnerability affects Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025, including the Server Core installation. All affected builds are identified by the corresponding CPE entries for Windows 11 and Windows Server 2025.

The CVSS score of 6.8 places the vulnerability in the moderate severity range, and the EPSS score is not available, making it difficult to assess the exact likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the publicly released proof of concept, the attack vector appears to be local or requires elevated privileges, but this inference is not confirmed in the official description.