EUVD-2026-64056Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:L because exploitation requires physical or logical possession of the volume file; PR:N since no OS authentication is needed for offline password attack; C:H for full volume plaintext recovery; I:N and A:N as the flaw solely reduces key derivation cost.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-256 and SHA-512 volume-header key derivation through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c, where the configured iterations value is discarded and wc_HKDF is used instead of PBKDF2-HMAC. Changing the PIM or iteration count therefore does not increase derivation cost, allowing an attacker with an affected container, disk image, or volume header to perform substantially cheaper offline password guesses. Official precompiled VeraCrypt binaries and normal distribution packages use the standard PBKDF2 backend and are not affected. Volumes created by an affected WOLFCRYPT=1 build require backup and recreation because corrected builds derive different keys. This issue is fixed in version 1.26.29.
AnalysisAI
Key derivation in VeraCrypt's non-default wolfCrypt backend silently substituted HKDF for PBKDF2-HMAC in SHA-256 and SHA-512 volume-header derivation, discarding the configured iteration count entirely - meaning any PIM or iteration tuning applied by users of affected builds provided zero additional brute-force resistance. Any attacker who obtains a volume file produced by a WOLFCRYPT=1 source build can attempt password recovery at HKDF speeds rather than PBKDF2-iterated cost, dramatically reducing the work factor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be satisfied for exploitation: first, the targeted volume must have been created by a VeraCrypt binary built from source with both WOLFCRYPT=1 and WOLFCRYPT_BACKEND enabled - a non-default configuration not used in any official release; second, the attacker must have physical or logical possession of the volume file, disk image, or exported volume header. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly captures that exploitation requires local possession of the volume file - a meaningful prerequisite that forecloses opportunistic remote exploitation entirely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Users of custom wolfCrypt-backend VeraCrypt builds must upgrade to version 1.26.29 (https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29), rebuild wolfSSL with the --enable-pwdbased configure flag, and recompile VeraCrypt. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when run
Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibl
The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.1
VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe. Rated high severity (CVSS 7.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-
IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffe
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today