Two New Windows Zero-Days Target BitLocker and CTFMON Privilege Escalation

Same Researcher, Same Pattern, Two More Unpatched Problems

If the name Chaotic Eclipse rings a bell, it should. This is the same anonymous researcher who previously surfaced three unpatched Microsoft Defender vulnerabilities and apparently decided that wasn't enough. Now we have YellowKey and GreenPlasma — two new zero-days that, taken together, represent a fairly uncomfortable combination for Windows defenders.

YellowKey: BitLocker Bypass

BitLocker is the encryption control that a significant portion of enterprise Windows deployments lean on as a primary data-at-rest safeguard. The assumption baked into most threat models is that if a device is lost, stolen, or briefly accessed by an unauthorized party, the encrypted volume buys you time — or outright stops the attacker cold.

YellowKey challenges that assumption directly. The details of the exact mechanism are not yet fully public, which is frustratingly common with researcher-disclosed zero-days that haven't gone through coordinated disclosure. What we do know is that the bypass is real enough that Chaotic Eclipse felt confident publishing it. For operators, the immediate takeaway is this: BitLocker alone is not a sufficient control right now if you're operating in an environment where physical or low-privilege logical access is a realistic threat vector. Layered controls — TPM + PIN configurations, pre-boot authentication, and monitoring for unexpected volume mount events — matter more today than they did last week.

GreenPlasma: CTFMON Privilege Escalation

CTFMON (Collaborative Translation Framework Monitor) is one of those Windows components that most operators know exists but few think about deeply. It runs as part of the text services framework, handling input method editors and handwriting recognition. It's also, apparently, a privilege escalation surface.

GreenPlasma abuses CTFMON to escalate privileges — the source doesn't yet detail whether this lands at SYSTEM or a high-integrity user context, but either outcome is operationally significant. Privilege escalation vulnerabilities become dramatically more dangerous when chained with initial access techniques. A low-privilege foothold plus GreenPlasma is a substantially worse situation than either alone. If you're running endpoint detection that monitors for unusual CTFMON behavior or unexpected privilege transitions in the text services stack, now is a good time to verify those detections are actually firing in your environment.

The Coordinated Disclosure Question

It's worth being direct about the disclosure posture here. Chaotic Eclipse has now published five zero-days targeting Microsoft components without apparent coordinated disclosure with Microsoft prior to publication. We're not going to editorialize endlessly about researcher ethics — that debate is well-worn — but operators need to understand what this means practically: there are no patches available, and Microsoft's response timeline is unknown. This isn't a situation where you're waiting 30 days post-patch to see exploit code drop. The exploit details are already out.

Microsoft has not, as of this writing, issued a CVE assignment or public acknowledgment for either YellowKey or GreenPlasma based on what the source reports. That means your patch management process won't catch this. Your vulnerability scanner won't flag it. The burden falls entirely on compensating controls and detection.

What Operators Should Do Right Now

• BitLocker configurations: Audit whether pre-boot authentication (TPM + PIN or TPM + USB key) is enforced across your fleet. Pure TPM-only configurations are the most exposed to bypass scenarios.
• CTFMON exposure: On servers and hardened workstations where text input framework services aren't needed, evaluate whether CTFMON can be disabled or its attack surface reduced via AppLocker or WDAC policies.
• Detection coverage: Review EDR rules for privilege escalation chains involving Windows input/text services components. If your ruleset doesn't cover CTFMON-adjacent activity, flag it for your detection engineering team.
• Threat intel tracking: Watch for a CVE assignment from Microsoft — that's your signal that an official patch is in the pipeline.
• Patch cadence: Given this researcher's track record of serial disclosure, treat any upcoming Patch Tuesday as higher-priority than usual for Windows core component updates.

The pattern Chaotic Eclipse is establishing — drop vulnerabilities publicly, let the ecosystem scramble — puts defenders in a reactive posture. We've seen this movie before with other prolific researchers, and the organizations that fare best are the ones who have compensating controls deep enough that a single unpatched zero-day doesn't represent a clean path to compromise.

Full details on both YellowKey and GreenPlasma are available in the original reporting at The Hacker News.