Security researcher Chaotic Eclipse (aka Nightmare-Eclipse) has released a new Windows BitLocker bypass exploit dubbed GreatXML, just one day after publishing a similar tool targeting Microsoft Defender. The researcher described the discovery as accidental, stating it took approximately four hours to find the vulnerability.
The exploit targets the Windows recovery partition, manipulating XML files that the system parses during boot. By injecting malicious XML content into this partition, the attacker can circumvent BitLocker's full-disk encryption and gain unauthorized access to data. No CVE identifier has been assigned yet, and the exploit code has been shared on a public blog.
Chaotic Eclipse noted the vulnerability is tied to how Windows handles XML files during the recovery process, specifically when the system attempts to use the Windows Defender Offline Scan utility. The attack vector requires physical access to the target machine, suggesting a local or forensic threat profile rather than remote exploitation.
Microsoft has not issued a statement or patch addressing GreatXML as of this writing. The researcher's claims have not been independently verified by security firms. Users concerned about physical attacks should consider using TPM-based protections, strong BIOS passwords, and disabling USB booting as interim mitigations.
Counter_argument: Some security analysts caution that the exploit requires physical access and boot-level manipulation, which limits its real-world applicability. Microsoft may treat this as a design limitation rather than a security vulnerability, potentially leaving it unpatched.