VeraCrypt CVE-2026-77572

Requires (1) local interactive or code-execution access as any user account on a Windows system, and (2) VeraCrypt 1.26.29 or earlier installed so the vulnerable veracrypt.sys driver and its intentionally user-accessible \.\VeraCrypt device are present. The attacker must invoke one of the specific metadata handlers - TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY - with an object-manager/device path outside the supported VeraCrypt workflow scope. Limiting factors: exploitation is strictly local (no remote vector), yields only low-sensitivity metadata (drive letters, partition/geometry/GPT-MBR info, limited object-manager paths) with no write/integrity or availability impact, and is fully neutralized on hosts updated past the fixing commit, which validates allowed paths and removes the legacy geometry IOCTL.

All signals converge on LOW real-world priority. The provided CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 3.3) requires local access by an already-authenticated low-privileged user, yields only low confidentiality impact, and has no integrity or availability impact - consistent with the CWE-200 information-disclosure classification and the description, which stresses that only 'low-sensitivity' metadata (drive-letter targets, partition info, disk geometry, GPT/MBR state, limited object-manager path strings) is exposed. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of exploitation interest; absence of these is not itself an error but means no probabilistic or in-the-wild signal elevates this. The GitHub source-code evidence confirms a genuine fix (new path-grammar validators ConsumePathLiteral/IsAllowedDevicePathForMetadata gating the affected IOCTLs and outright removal of the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler), so the flaw is real and vendor-acknowledged, but nothing contradicts the low severity. Net: a legitimate but low-impact local info-leak, not an urgent patch priority outside high-assurance endpoints where VeraCrypt metadata exposure matters.

A local user with an ordinary account on a Windows host running VeraCrypt 1.26.29 or earlier opens the intentionally user-accessible \.\VeraCrypt device and issues a metadata IOCTL (e.g. TC_IOCTL_GET_RESOLVED_SYMLINK or TC_IOCTL_GET_DRIVE_PARTITION_INFO) supplying an object-manager or device path outside the paths normal VeraCrypt workflows use. The driver performs the kernel-context symbolic-link or disk-device lookup and returns drive-letter, partition, geometry, and GPT/MBR metadata the user would not otherwise have scoped access to. No public exploit was identified at time of analysis, though the fixing commit (ca35405) illustrates exactly which IOCTLs and path shapes are abusable.