GreatXML BitLocker 0-Day Bypass Exploited Through Defender Offline Scan

A newly disclosed zero-day vulnerability dubbed “GreatXML” allows attackers to completely bypass BitLocker encryption on Windows machines, and the attack vector is one few would suspect: Microsoft Defender’s own Offline Scan feature.

The vulnerability was discovered by security researcher NightmareEclipse, who went from initial observation to a working proof of concept in only four hours.

The researcher has published full technical details, including GitHub and two self-hosted Git instances, making this an active public disclosure without a coordinated patch from Microsoft.

The GreatXML bypass exploits an interaction between the Windows Recovery Environment (WinRE) and the unattend.xml configuration file used during offline scanning.

GreatXML BitLocker 0-Day Bypass Exploited

When a victim machine has ever had Windows Defender Offline Scan initiated even just once in its history, the device becomes permanently susceptible to exploitation without any login required.

An attacker with physical access to the target device can copy a specially crafted unattend.xml file and a Recovery directory to the root of the machine’s recovery partition.

Upon rebooting into WinRE via Shift + Restart, the recovery environment parses the crafted files without proper integrity validation, spawning a shell with unrestricted access to the BitLocker-protected volume, no decryption key required.

The vulnerability manifests in two distinct scenarios:

• High-impact (no login needed): If Defender Offline Scan was ever initiated on the target machine, the attacker can bypass the full authentication process entirely without authenticating to Windows. The machine is passively vulnerable.
• Standard scenario: If Offline Scan was never triggered, an attacker must either log in and initiate the scan themselves, or find a method to boot directly into WinRE in an offline scan state a condition the researcher believes is achievable without prior login.

The NightmareEclipse researcher has noted that additional exploitation scenarios likely exist beyond what has been publicly documented, though further research has not been pursued at this time.

The flaw is rooted in WinRE’s weak validation of external configuration files, a pattern consistent with other recently disclosed vulnerabilities in the Windows Recovery Environment.

The unattend.xml file, typically used for automated Windows setup and recovery tasks, is parsed during the WinRE boot process without sufficient integrity checks.

This mirrors the design flaw in BitLocker bypass chains, where WinRE processes files from unprotected storage volumes, enabling malicious tampering that circumvents BitLocker’s authentication flow.

The attack is particularly dangerous because BitLocker Version 2.0 with XTS-AES 128 encryption at 100% encryption and “Protection On” status provides no defense once the recovery environment itself is weaponized, as evidenced in the accompanying proof-of-concept screenshots showing a fully encrypted C: drive being accessed freely.

Any Windows system that has used Defender Offline Scan as a common action recommended during malware investigations may be vulnerable.

The use of TPM-only BitLocker protection (without a PIN) is a key contributing factor, consistent with the wider class of WinRE-based BitLocker bypasses affecting Windows 11 and Windows Server 2025.

Mitigations

While no official patch exists for GreatXML at the time of publication, defenders should take the following steps immediately:

• Switch BitLocker from TPM-only to TPM+PIN mode via PowerShell, Group Policy, or Control Panel this requires a PIN at startup and blocks recovery-environment-based bypass attacks
• Restrict physical access to sensitive endpoints, as this is a physical-access attack vector
• Monitor WinRE integrity, including auditing the recovery partition for unexpected files such as unattend.xml or unauthorized Recovery directories

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post GreatXML BitLocker 0-Day Bypass Exploited Through Defender Offline Scan appeared first on Cyber Security News.