VeraCrypt CVE-2026-108982

Exploitation requires the macOS FUSE-T build of VeraCrypt 1.26.29 specifically - the macFUSE build is explicitly not affected. The decrypted-data exposure only arises after a volume has been mounted and then dismounted, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its core-service helper processes; those leaked processes continue serving the decrypted volume.dmg over a loopback SMB session and retain an open handle to the raw device. The attacker must already be a local user or process on the same host (PR:L, AV:L) and must act on the stale auxiliary mount, e.g. by reattaching volume.dmg or reopening a previously accessed path via the macOS Open Recent menu. Limiting factors: no remote vector, authenticated local access required, build-specific (FUSE-T only), and dependent on a prior mount/dismount having occurred, which is why CVSS 4.0 assigns AT:P.

This is a genuine but conditional confidentiality risk rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) scores 7.2 (High) and is internally consistent with the description: exploitation is local (AV:L), requires an already-authenticated low-privilege local user (PR:L), and carries an Attack Requirement (AT:P) reflecting that the victim must have previously mounted and then dismounted a volume so the leaked go-nfsv4 and core-service helpers remain alive. VC:H/VI:H are justified because a remounted decrypted volume exposes and can modify plaintext data; VA:N is reasonable since availability is not impacted. No EPSS score, CISA KEV entry, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the risk is driven by impact (bypass of at-rest encryption) rather than by likelihood of broad automated attack. The real-world audience is narrow: only the macOS FUSE-T build is affected (macFUSE build explicitly not affected) and an attacker must already have local access to the same machine, so this is a post-compromise / insider / multi-user-workstation concern, not a remote threat.

A privacy-conscious user mounts an encrypted VeraCrypt volume (FUSE-T build) on their Mac, works with sensitive files, then dismounts it believing the plaintext is gone. Because the go-nfsv4 auxiliary service and VeraCrypt core-service helpers are never terminated, the decrypted volume.dmg keeps being served over a loopback SMB session; a second local user, a malicious local process, or even the same user via an 'Open Recent' path can reattach that stale mount and read or alter the decrypted data without ever supplying the passphrase. No public exploit code is known, and the attack requires local access plus a prior mount/dismount cycle.