Confused Recovery: A New Attack Class on Windows Recovery

No ratings

Presented at DEF CON Singapore 2026 by

Alon Leviev

The Windows Recovery Environment (WinRE) is a foundational component of the Windows stack, embedded in over a billion devices and responsible for system recovery from severe failures. A key requirement of any recovery operation is correctly identifying its associated disk volume. To support this, WinRE implements volume lookup logic independently in both its boot phase and runtime phase. Maintaining separate mechanisms for retrieving the same information has historically been fragile and error prone. This raises a critical question: what happens when these lookup mechanisms fall out of sync? In this talk, we introduce a new attack class targeting WinRE. We analyze the different volume lookup implementations and the inconsistencies between them. We then reveal 4 new vulnerabilities that allow attackers to confuse WinRE into recovering an attacker‑controlled volume instead of the intended one. Using these confusion primitives, we present 2 new exploitation techniques that escalate the impact to a full BitLocker bypass, enabling extraction of BitLocker secrets. We conclude by describing our collaboration with engineering teams to develop a mitigation addressing this entire attack class. This work highlights how combining knowledge of BitLocker, Windows Boot, and Windows Recovery leads to impactful findings.