cve-2026-45585

CVE-2026-45585, also known as YellowKey, is a publicly disclosed Windows 11 BitLocker bypass vulnerability that exploits Windows Recovery Environment behavior to expose encrypted drives to attackers with physical access. Microsoft acknowledged the issue in mid-May 2026 after researcher Nightmare-Eclipse published proof-of-concept details outside coordinated disclosure norms. The vulnerability forced Microsoft to turn the June 9, 2026 security release for hotpatch-capable Windows 11 Enterprise LTSC 2024 into a restart-required baseline update, replacing the expected hotpatch. This incident highlights that BitLocker's weakest point may be the recovery machinery rather than encryption itself, and that hotpatching's no-restart promise has limits when a disclosed vulnerability changes the risk equation.