A newly discovered zero-day exploit targeting Windows 11 allows attackers with physical access to bypass BitLocker encryption and gain full control over the system's filesystem and internal drivers.

Key Points

• Cybersecurity researcher Chaotic Eclipse identified the "YellowKey" and "GreenPlasma" vulnerabilities affecting Windows 11 and Windows Server 2022/2025.
• The exploit utilizes a USB drive and the Windows Recovery Environment to bypass encryption and open a system command prompt.
• Security experts Kevin Beaumont and Will Dormann have confirmed the existence of the flaw, which currently lacks an official Microsoft patch.
• Users are advised to set a BIOS/UEFI administrator password and enable a BitLocker PIN to mitigate the risk of unauthorized physical access.

Why it Matters

This vulnerability highlights a significant security gap in how Windows 11 handles encryption during the boot process, potentially exposing sensitive data on stolen or unattended devices. Until Microsoft releases a formal patch, enterprise and individual users remain at risk of sophisticated physical attacks that circumvent standard security protocols.