VeraCrypt CVE-2026-54073

Exploitation requires that the victim previously created a file-hosted hidden volume using VeraCrypt 1.26.6 through 1.26.28 - the plaintext markers are introduced at hidden volume creation time, not during normal use. The attacker (e.g., forensic examiner) must have physical or forensic-level read access to the container file; no special privileges beyond file readability are required once access is obtained. Device-hosted hidden volumes (created on raw partitions or physical disks) are not affected because the vulnerable code path is explicitly conditioned on !bDevice. Outer volumes and non-hidden file containers are also unaffected. Exploitation is further limited by the fact that no hidden-volume content is disclosed - only the existence of the hidden volume becomes detectable - and by the requirement for prior physical access to the device, which represents a substantial real-world barrier. The CVSS UI:A metric confirms that the victim's active creation of a hidden volume is a prerequisite for the vulnerability to manifest.

The CVSS 4.0 score of 4.6 (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N) accurately reflects a local-access, user-interaction-dependent flaw with low confidentiality impact, and the real-world risk profile closely tracks this rating for most users. Enterprises and general-purpose encryption users face negligible operational risk since encryption strength and data confidentiality are entirely unaffected. Risk is concentrated among threat-model-specific populations - journalists, dissidents, activists, and human rights workers - for whom plausible deniability failure during device seizure or border inspection is a high-consequence event. Exploitation requires physical or forensic-level access to the container file, meaning the attacker is already in a position of significant advantage. No EPSS data was provided; given the niche threat model and local-only attack vector, mass exploitation probability is low, though targeted risk for high-risk individuals may be elevated. This vulnerability is not listed in CISA KEV, and no POC or exploit code has been publicly identified. There is no conflict between CVSS signals and the description - all indicators consistently point to a low-to-medium real-world priority except for users with active deniability threat models.

A forensic examiner seizes a device containing a VeraCrypt file-hosted container suspected of holding a hidden volume. Using a hex editor or forensic imaging tool, the examiner scans the container at 128 MiB boundaries and observes zeroed sectors where uniformly encrypted data is expected, confirming the hidden volume was created on a vulnerable VeraCrypt version and undermining the owner's deniability claim. No exploit code or POC has been publicly identified; this scenario requires physical or legal access to the container file and is not exploitable over a network.