Skip to main content

VeraCrypt CVE-2026-54073

| EUVDEUVD-2026-64057 MEDIUM
Protection Mechanism Failure (CWE-693)
2026-08-21 GitHub_M
Information Disclosure Veracrypt
4.6
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
4.6 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local file access required by forensic examiner; victim's active hidden-volume creation is prerequisite (UI:R); confidentiality impact is low, limited to existence disclosure with no content exposure.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Patch available
Aug 21, 2026 - 20:02 EUVD
Source Code Evidence Fetched
Aug 21, 2026 - 19:31 vuln.today
Analysis Generated
Aug 21, 2026 - 19:31 vuln.today

DescriptionCVE.org

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

AnalysisAI

Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the victim previously created a file-hosted hidden volume using VeraCrypt 1.26.6 through 1.26.28 - the plaintext markers are introduced at hidden volume creation time, not during normal use. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 4.6 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N) accurately reflects a local-access, user-interaction-dependent flaw with low confidentiality impact, and the real-world risk profile closely tracks this rating for most users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: VeraCrypt 1.26.29, available at https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Veracrypt

View all
CVE-2015-7358 HIGH POC
7.8 Oct 03

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when run
CVE-2016-1281 HIGH POC
7.8 Jan 23

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibl
CVE-2015-7359 HIGH
7.8 Oct 03

The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.1
CVE-2019-19501 HIGH
7.8 Dec 13

VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe. Rated high severity (CVSS 7.
CVE-2026-53762 MEDIUM
6.2 Aug 21

Key derivation in VeraCrypt's non-default wolfCrypt backend silently substituted HKDF for PBKDF2-HMAC in SHA-256 and SHA
CVE-2019-1010208 LOW
3.3 Jul 23

IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by: Buffe

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-54073 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy