# Windows Zero-Days: Analyzing YellowKey and GreenPlasma Exploits

> A technical breakdown of the unpatched YellowKey BitLocker bypass and GreenPlasma local privilege escalation vulnerabilities affecting Windows systems.

- Published: 2026-05-14T09:05:16.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: YellowKey, GreenPlasma, Windows, BitLocker, Privilege Escalation, LPE
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/researcher-drops-yellowkey-greenplasma-windows-zero-days/
- Canonical: https://runtimerebel.com/blog/windows-zero-days-analyzing-yellowkey-and-greenplasma-exploits

## Key points

- Immediate impact: Local attackers can gain SYSTEM privileges or bypass BitLocker encryption to access sensitive data on Windows workstations.
- Affected systems: Multiple versions of Microsoft Windows are susceptible to these unpatched exploits targeting disk encryption and local security tokens.
- Remediation: Implement strict physical access controls and monitor for suspicious local process spawning while awaiting official security updates from Microsoft.

A security researcher, known as hyp3rlinx, has publicly disclosed proof-of-concept code for two unpatched [Zero-Day](/glossary#zero-day) vulnerabilities affecting the Microsoft Windows ecosystem. These vulnerabilities, dubbed YellowKey and GreenPlasma, target critical components of Windows security: full-disk encryption and local authorization. According to [SecurityWeek](https://www.securityweek.com/researcher-drops-yellowkey-greenplasma-windows-zero-days/), these findings highlight persistent gaps in the Windows security model that allow for local [Privilege Escalation](/glossary#privilege-escalation) and the bypass of BitLocker protections.

While Microsoft has not yet assigned a [CVE](/glossary#cve) to either vulnerability, the public availability of exploit code increases the risk of adoption by various threat actors. Defenders must evaluate their exposure, particularly for devices in high-risk environments where physical access or local user access cannot be strictly monitored.

## Analysis of YellowKey BitLocker bypass physical access

The YellowKey vulnerability represents a specialized threat to data-at-rest protections. BitLocker is a core security feature designed to prevent unauthorized data access on lost or stolen devices. However, the YellowKey BitLocker bypass physical access exploit demonstrates that a user with direct access to the hardware can circumvent these protections. 

Technically, the exploit focuses on how Windows handles BitLocker recovery and the availability of the clear key in specific states. If a device is not properly decommissioned or if it is left in a state where the encryption keys are accessible in memory or via the hardware interface, YellowKey can facilitate the extraction of the volume master key. This allows an attacker to decrypt the drive without the user's password or PIN. The primary risk profile for this [TTP](/glossary#ttp) includes corporate laptops and workstations that are subject to theft or unauthorized physical tampering.

## GreenPlasma Windows privilege escalation exploit

While YellowKey focuses on data access, GreenPlasma targets the integrity of the operating system. The GreenPlasma Windows privilege escalation exploit allows a standard user account to elevate its permissions to the SYSTEM level. This is achieved by exploiting flaws in the way Windows manages local security tokens or inter-process communication mechanisms. 

In a typical attack scenario, a threat actor gains initial access via [Phishing](/glossary#phishing) or other means. Once inside the system, they use GreenPlasma to bypass User Account Control (UAC) and gain full administrative control. This level of access is a prerequisite for more advanced activities, such as disabling security software, installing persistent backdoors, or performing [Lateral Movement](/glossary#lateral-movement) across the network.

### Detection and Strategic Response

Security teams must identify how to detect GreenPlasma exploit activity within their environments. Since this is an LPE vulnerability, defenders should focus on monitoring for unusual parent-child process relationships. Specifically, [SOC](/glossary#soc) analysts should look for standard user processes spawning high-integrity shells or unexpected calls to security-sensitive APIs.

To mitigate the risk of these zero-days before an official patch is released, organizations should prioritize the following actions:

*   **Enhance EDR Monitoring:** Configure your [EDR](/glossary#edr) to alert on suspicious elevation attempts and the execution of unverified scripts that match known PoC behaviors.
*   **Physical Security:** Enforce strict policies regarding the physical security of portable devices and use hardware-based protections such as TPM (Trusted Platform Module) with enhanced PIN requirements to raise the bar for BitLocker bypasses.
*   **Log Aggregation:** Ensure that [SIEM](/glossary#siem) platforms are ingesting local security logs to identify any [IoC](/glossary#ioc) related to account manipulation or privilege changes.
*   **Principle of Least Privilege:** Minimize the number of users with local administrative rights to reduce the attack surface for local exploits.

Until Microsoft provides a formal fix, these vulnerabilities remain a viable path for attackers to gain deep persistence on Windows systems. Organizations should treat these disclosures as high-priority risks in their vulnerability management programs.

**Related:** [Windows BitLocker Zero-Day Bypass and Privilege Escalation PoC Released](/blog/windows-bitlocker-zero-day-bypass-and-privilege-escalation-poc-released), [Unpatched PhantomRPC: Windows Privilege Escalation via RPC Flaw](/blog/unpatched-phantomrpc-windows-privilege-escalation-via-rpc-flaw)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/windows-zero-days-analyzing-yellowkey-and-greenplasma-exploits