GreatXML exploit bypasses Windows BitLocker using Recovery Partition XML files

A newly disclosed “GreatXML” exploit is reported to bypass Windows BitLocker protection by leveraging files on the system’s Recovery Partition. Multiple sources describe how the exploit targets how Windows handles Recovery Mode content, specifically involving XML files located in the Recovery Partition. The researcher credited with the discovery is described as Chaotic Eclipse (also known by aliases including Nightmare-Eclipse and MSNightmare). The discovery is also linked to earlier work involving Microsoft Defender’s Offline Scan: one account says the proof of concept (PoC) uses that offline scanning process to spawn a SYSTEM shell after rebooting in Recovery Mode, which then enables the BitLocker bypass. Another source frames the bypass as occurring through the use of recovery partition XML files. The reports note that the researcher released details shortly after publishing an exploit for Microsoft Defender, describing the work as an accidental find that took a limited amount of time. Across coverage, the common theme is that GreatXML uses a chain involving Recovery Mode and Defender-related offline behavior to achieve elevated access and circumvent BitLocker, with the PoC tied to recovery partition components. The reports do not describe a specific mitigation in the provided excerpts.