CVE-2026-108982
Received Received - Intake

Vulnerability in VeraCrypt FUSE-T Build on macOS Leads to Unintended Data Access

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: MITRE

Description
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108982
EUVD
EUVD-2026-97161

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IDRIX VeraCrypt 1.26.29

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in VeraCrypt 1.26.29 (FUSE-T build) on macOS allows unintended access to decrypted data after a volume is dismounted. The FUSE-T auxiliary service and VeraCrypt core-service helper processes do not terminate properly when a volume is dismounted. This means the decrypted volume image remains accessible via a loopback SMB session, allowing local users or processes to remount and access the decrypted data without the passphrase.

Detection Guidance

Check for lingering VeraCrypt core-service or FUSE-T processes after dismounting a volume. Use commands like 'ps aux | grep -E "veracrypt|fuse-t"' to list active processes. Verify if /Volumes/.veracrypt_aux_mnt* paths still exist or if files from previously mounted volumes can be reopened without a passphrase.

Impact Analysis

This vulnerability could allow unauthorized local access to decrypted files even after a volume is dismounted. An attacker could reopen files without a password using applications like Preview's 'Open Recent' menu or attach the volume image directly. It may also cause system instability, such as kernel panics during sleep/wake cycles, and prevent proper ejection of physical disks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If decrypted data remains accessible without proper authentication, organizations may fail to meet data protection and access control obligations, potentially resulting in compliance violations and legal consequences.

Mitigation Strategies

Update VeraCrypt to the latest patched version that includes the fix for FUSE-T process termination. Avoid using the FUSE-T build of VeraCrypt on macOS until the patch is applied. Manually kill any lingering processes with 'kill -9 <PID>' if detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart