EUVD-2026-31006
GHSA-2h24-8rjh-qgjv
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
1DescriptionCVE.org
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available.
AnalysisAI
Windows security feature bypass, publicly dubbed 'YellowKey', exposes systems to full confidentiality, integrity, and availability compromise via command injection (CWE-77) requiring only physical access - no credentials or user interaction needed. A proof-of-concept was released publicly prior to patch availability, violating coordinated disclosure norms, which lowers the attacker skill bar significantly. No vendor-released patch exists at time of analysis; Microsoft has confirmed the issue and is preparing a security update.
Technical ContextAI
CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates that some Windows interface - likely a pre-boot environment, locked-screen shell, recovery console, or accessible diagnostic utility - fails to sanitize special characters, allowing injected OS commands to execute with elevated or system-level privilege. The CVSS vector AV:P (Physical) confirms exploitation requires hands-on access to the hardware, while PR:N and AC:L indicate no credentials are needed and the injection point is trivially reachable once physical presence is established. The 'security feature bypass' classification suggests the command injection is used to circumvent a protective mechanism such as Secure Boot enforcement, Windows Defender credential guard, disk encryption lock, or a kiosk-mode restriction, rather than being a standalone RCE class on a normally running system. Affected CPE strings are not enumerated in the available intelligence; consult the MSRC advisory for exact product and version scoping.
RemediationAI
No vendor-released patch is available at time of analysis - Microsoft's advisory language explicitly states mitigation guidance is being issued 'until the security update is made available.' Monitor https://msrc.apple.com/update-guide/vulnerability/CVE-2026-45585 and Microsoft's Patch Tuesday release cycle for the forthcoming fix, and apply it immediately upon release. In the interim, enforce strict physical access controls as the primary compensating measure: restrict physical access to Windows endpoints to authorized personnel only, and treat unattended device scenarios (hotels, open offices, shared kiosks) as elevated risk. Enable BitLocker with a pre-boot PIN (not TPM-only) to require a secret for device access before Windows loads, limiting attack surface on the interface likely targeted by YellowKey - trade-off is user friction at boot. Configure BIOS/UEFI with an administrator password and disable booting from external media to prevent circumvention via live OS. Enable Secure Boot and verify TPM-based attestation is active. For shared or kiosk Windows deployments, evaluate whether devices can be physically secured (cable locks, locked enclosures) or temporarily taken offline until the patch is available. Do not rely on software-layer mitigations alone given the physical-access attack vector.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today