New GreatXML Exploit Bypasses Windows Bit Locker via Recovery Partition XML Files
Summary: Security researcher Chaotic Eclipse released a Windows BitLocker bypass called GreatXML, which the researcher says took four hours to find and which spawns a shell with unrestricted access to the BitLocker volume if every step is followed correctly. Researcher Will Dormann called the reproduction steps flawed, noting that triggering a Defender Offline Scan requires being logged in with admin credentials, and Microsoft said it is aware of the reported vulnerability and actively investigating the validity and potential applicability of the claims.
What you should know: This is the second BitLocker bypass from the same researcher in quick succession, after YellowKey (CVE-2026-45585) was patched this week, and Microsoft has not yet confirmed whether GreatXML is real - so the question is whether your BitLocker recovery assumptions hold if it is.
Read the original at The Hacker News ↗
- Mentions
- CVE-2026-45585
- Related