Zero-day exploit completely defeats default Windows 11 BitLocker protections

A newly disclosed zero-day, YellowKey, can bypass Windows 11’s default BitLocker protection with only physical access.

The exploit abuses a custom FsTx folder and Windows recovery behavior to reach a command prompt on the encrypted drive without the recovery key.

This weakens a core disk-encryption safeguard used by many organizations, including government contractors.

Researchers Kevin Beaumont and Will Dormann highlighted the issue, which involves TPM, Windows Recovery, and Transactional NTFS.