CVE-2026-77572

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in VeraCrypt Windows Driver

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \.\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77572

EUVD

EUVD-2026-101298

Affected Vendors & Products

Vendor	Product	Version / Range
veracrypt	VeraCrypt	<= 1.26.29

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-77572 is a low-severity vulnerability in the VeraCrypt Windows kernel driver affecting versions before 1.26.30. It involves missing authorization checks on certain IOCTL handlers, allowing local users with access to the VeraCrypt device to query low-sensitivity metadata about disk topology, symlink targets, and device information. The vulnerability does not expose sensitive data like passwords or encryption keys.

Detection Guidance

This vulnerability can be detected by checking the VeraCrypt version installed on your system. If you are running a version prior to 1.26.30, your system is affected. Run the command 'veracrypt --version' in the terminal to check the installed version.

Impact Analysis

This vulnerability allows a local user with access to the VeraCrypt device to obtain limited metadata about disk partitions, geometry, or symlink targets. It does not permit privilege escalation, arbitrary code execution, or access to sensitive data such as encryption keys or mounted volume contents.

Compliance Impact

This vulnerability does not directly expose sensitive data such as passwords, encryption keys, or mounted volume contents, which are typically the primary concerns for GDPR and HIPAA compliance. The issue only allows disclosure of low-sensitivity metadata like drive-letter targets, partition information, or disk geometry, which are generally not classified as protected health information or personal data under these regulations.

Mitigation Strategies

Immediately update VeraCrypt to version 1.26.30 or later to address the vulnerability. Download the latest version from the official VeraCrypt website or trusted repositories.

Hi! I’m here to help you understand CVE-2026-77572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70