CVE-2026-54073
Received Received - Intake

Vulnerability in VeraCrypt Hidden Volume Creation Weakens Plausible Deniability

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-54073
EUVD
EUVD-2026-64057

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
veracrypt veracrypt From 1.26.6 (inc) to 1.26.29 (exc)
veracrypt veracrypt From 1.26.6 (inc) to 1.26.29 (inc)
veracrypt veracrypt 1.26.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54073 is a vulnerability in VeraCrypt versions 1.26.6 to 1.26.28 affecting file-hosted hidden volume creation. When creating a hidden volume, VeraCrypt writes raw zeroed sectors at predictable 128 MiB intervals in the container file, bypassing normal encryption. This creates plaintext markers in areas expected to be random ciphertext, weakening plausible deniability during forensic analysis.

Detection Guidance

The vulnerability creates predictable plaintext markers at 128 MiB intervals in hidden volume containers. To detect it, inspect VeraCrypt container files for zeroed sectors at these intervals using forensic tools like 'hexdump' or 'dd' to analyze raw data patterns. Compare file sizes against expected values for hidden volumes.

Impact Analysis

This vulnerability impacts users who rely on VeraCrypt's hidden volumes for plausible deniability. The predictable zeroed sectors could be detected during forensic inspection, potentially revealing the existence of a hidden volume even if its contents remain encrypted and secure. An attacker with access to the container file could identify these markers.

Compliance Impact

This vulnerability does not directly compromise encryption strength or expose hidden data, but it weakens plausible deniability by creating detectable plaintext markers in hidden volumes. For compliance standards like GDPR or HIPAA, which require data protection and confidentiality, this could undermine claims of secure data handling if forensic analysis reveals inconsistencies in encrypted storage. However, the issue does not directly violate these regulations unless deniability is a documented requirement.

Mitigation Strategies

Upgrade VeraCrypt to version 1.26.29 or later to resolve the issue. If upgrading is not possible, avoid creating file-hosted hidden volumes in affected versions. Review existing hidden volumes for forensic anomalies and consider recreating them after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54073. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart