Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

A cybersecurity researcher disclosed two new Windows zero-days: YellowKey (BitLocker bypass) and GreenPlasma (CTFMON privilege escalation).

• •YellowKey exploits WinRE to bypass BitLocker by copying specially crafted FsTx files to USB, affecting Windows 11 and Server 2022/2025
• •GreenPlasma leverages Windows CTFMON arbitrary section creation to escalate privileges to SYSTEM level
• •Transactional NTFS on USB drives can modify files on other volumes when replayed in WinRE
• •A separate BitLocker downgrade attack using CVE-2025-48804 bypasses encryption in under five minutes via boot manager vulnerability
• •The researcher previously disclosed BlueHammer, RedSun, and UnDefend Defender vulnerabilities citing frustration with Microsoft's disclosure process