Zero-day exploit completely defeats default Windows 11 BitLocker protections

A recently discovered zero-day exploit, known as YellowKey, can completely bypass default BitLocker protections in Windows 11, allowing attackers with physical access to gain instant access to encrypted drives. This exploit, published by researcher Nightmare-Eclipse, targets the full-volume encryption protection provided by Microsoft, which is typically stored in a trusted platform module. The vulnerability can be exploited in a matter of seconds, rendering the default BitLocker protections ineffective. The fact that this exploit can bypass default Windows 11 deployments of BitLocker is particularly concerning, as it undermines the security of the encryption protection¹. This highlights the need for immediate assessment of exposure, especially given the short window of time available before patches are released. So what matters to practitioners is that the window for patching is already closing, making it essential to evaluate their systems' vulnerability to this exploit.