Read the docs
TI-2026-39004 Aliases CVE-2026-54073

VeraCrypt: Hidden volume quick format weakens plausible deniability

Priority MEDIUM 54CWE-693Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-693.

Summary

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed VeraCrypt (veracrypt): 1.26.29

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
veracryptVeraCrypt1.26.6 to before 1.26.291.26.29Patch availableCNA
  • VeraCrypt Vendorveracrypt Affected 1.26.6 to before 1.26.29 Fixed in 1.26.29 Patch available CNA

Remediation

  • Fix · CNA VeraCrypt (veracrypt) Fixed in 1.26.29

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54073

References

Other 3

  • TI-2026-38769 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds) CVSS 3.1MEDIUM 6.2
  • TI-2026-85262 Heap overflow and out-of-bounds read in VeraCrypt deserialization CVSS 4.0HIGH 8.8
  • TI-2026-74032 Missing authorization in VeraCrypt driver exposes disk metadata CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences