What happened?
An IT security researcher operating under the names "NightmareEclipse" (GitHub) and "Chaotic Eclipse" (Blogspot), who had previously disclosed the vulnerabilities "RedSun," "UnDefend," and "BlueHammer," has uncovered two additional security flaws in Windows. The more serious vulnerability, named "YellowKey," affects BitLocker drive encryption. Additionally, under the name "MiniPlasma," he discovered a privilege escalation flaw in a Windows driver that can grant attackers SYSTEM privileges.
The details
The "MiniPlasma" privilege escalation flaw affects the "Windows Cloud Files Mini Filter." Microsoft had already released a patch for this back in 2020, tracked under CVE-2020-17103 (CVSS score 7.0, risk rating "high"). It remains unclear whether this patch was later withdrawn or whether Microsoft simply failed to roll it out comprehensively. What is certain is that the vulnerability, originally reported by Google's Project Zero at the time, can still be exploited. Both the new proof-of-concept exploit on GitHub and the old PoC from Google reportedly still work and grant attackers SYSTEM privileges.
The "YellowKey" vulnerability in BitLocker requires more attention. Similar to the recently disclosed attack based on BitUnlocker, attackers need local physical access to the target device. The process works as follows: the folder "\System Volume Information\FsTx" is copied onto a simple USB stick with a Windows-compatible file system (FAT, FAT32, exFAT, or NTFS). This stick is then connected to a computer with BitLocker enabled. By holding down the Shift key during system startup, the device can be booted into the Windows Recovery Environment. There, attackers click "Restart" and then hold down the Ctrl key. This launches a shell with unrestricted access to the drive that is actually supposed to be protected by BitLocker.
The attack reportedly works on Windows 11 as well as Windows Server 2022 and 2025. The Windows Recovery Environment in Windows 10 is not affected. Particularly concerning: protective measures that help mitigate BitUnlocker-derived attacks—such as requiring a PIN before decryption and TPM protection—apparently do not prevent "YellowKey."
IT security expert Will Dormann tested the exploit and published his observations on Mastodon. According to him, holding down the Ctrl key is not even strictly necessary to gain access to the BitLocker-protected shell. The exact mechanism is not yet fully understood, but there are strong indications that the "\System Volume Information\FsTx" folder, which belongs to Transactional NTFS, can be used to unlock the contents of other drives. A user comment on Dormann's post also notes that in one tested case, the C drive was unlocked while the D drive was not—suggesting the vulnerability does not behave consistently in every case.
Another noteworthy point from the researcher's blog post: Microsoft appears to have silently fixed the previously reported "RedSun" vulnerability, which grants attackers admin rights, with the updates from the most recent Patch Tuesday—without publishing an accompanying CVE entry.
Assessment
These findings are relevant for security infrastructure operators and IT administrators because they affect core Windows protection mechanisms. BitLocker is considered a standard tool for protecting sensitive data on endpoint devices, for example in companies with mobile workstations or in environments where hardware theft is a significant risk. If this protection can be bypassed using relatively simple means—a USB stick and physical access—it significantly diminishes the value of the encryption, particularly in scenarios where devices are lost or stolen.
The "MiniPlasma" privilege escalation flaw should also be taken seriously, as it demonstrates that a vulnerability already known—and supposedly patched—since 2020 apparently remains exploitable. This raises questions about how Microsoft tracks and distributes security updates, and underscores that organizations should not rely solely on the existence of a patch but must regularly verify its actual effectiveness.
Practical tips
- Consistently restrict physical access to devices, for example through access controls for rooms containing sensitive IT equipment and through BIOS/UEFI passwords that prevent booting from external storage media.
- Where possible, disable or restrict USB ports on critical systems via policy or hardware solutions when there is no operational need for them.
- Pay particular attention to the Windows Recovery Environment and boot options on affected systems (Windows 11, Server 2022/2025), and make access to them more difficult through appropriate group policies.
- Regularly verify patch status instead of relying solely on the installation of an update—especially for older, previously reported vulnerabilities such as CVE-2020-17103.
- Install current Windows updates promptly, as Microsoft reportedly already silently fixed the "RedSun" vulnerability in the most recent Patch Tuesday updates.
- In particularly sensitive environments, consider additional physical security measures, such as storing sensitive hardware in drop safes or secured server cabinets, to prevent unauthorized physical access from the outset.
Outlook
It remains to be seen how Microsoft will respond to the "YellowKey" and "MiniPlasma" reports and whether official patches with corresponding CVE entries will be released promptly. The fact that the exact mechanism behind the BitLocker vulnerability is reportedly not yet fully understood also suggests further investigation by the security research community can be expected. Until then, IT administrators should not neglect the physical security of their devices as a complementary layer of protection to drive encryption, since it has become clear that software-based protection mechanisms alone cannot guarantee complete security.
