Preface: “YellowKey” and “Bitskrieg” are critical security vulnerabilities recently disclosed in May and June 2026, allowing attackers with physical access to bypass Microsoft BitLocker full disk encryption for Windows 11 and Windows Server 2022/2025. These techniques exploit flaws in the Windows Recovery Environment (WinRE) to access data without passwords or recovery keys!
Background: The TCG2 protocol (or EFI_TCG2_PROTOCOL) is directly related to the TPM 2.0 (Trusted Platform Module) specification because it acts as the standardized software bridge that allows UEFI firmware to communicate with the TPM 2.0 hardware during the pre-boot process
While older TCG1.2 protocols only provided SHA-1 digests, the TCG2 protocol is designed to support the TPM 2.0 library specification, allowing it to support multiple hash algorithms (SHA-1, SHA-256, etc.) and handle the “hash agility” required by modern security standards.
The vulnerability exists within how Windows BitLocker handles pre-boot verification or fails to strictly enforce protection mechanisms when local files are supplied via a USB drive or an unauthenticated EFI System Partition (ESP) during boot. It is a logic flaw in Microsoft’s BitLocker state transition, not an inherent flaw in the TCG2 protocol itself.
The Windows Recovery Environment (WinRE) or Boot Manager processes an unauthenticated folder/file structure (such as the transactional FSTX structures) directly from an unauthenticated USB drive or EFI System Partition.
Vulnerability details:
Missing Logic Validation: System state-transition logic proceeds to initialize and map the environment blindly without verifying the cryptographic signature (db databases) of the files interacting with the boot path.
The Exploit Vector: An attacker inserts a prepared USB stick containing specific malformed transactional files. BitLocker’s recovery or repair logic processes them, bypasses the expected authentication check, and drops into an elevated command prompt with the volume fully decrypted.
Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2026-50507