SB2026072470 - Multiple vulnerabilities in VeraCrypt

Description

This security bulletin contains information about 2 vulnerabilities.

1) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-54073)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to weaken hidden-volume plausible deniability.

The vulnerability exists due to improper data neutralization in the hidden volume quick-format path when creating a file-hosted hidden volume. A remote attacker can create a crafted hidden volume to weaken hidden-volume plausible deniability.

User interaction is required to create the hidden volume, and the issue affects hidden file-hosted volumes larger than 128 MiB that use the no-filesystem or FAT formatting paths.

2) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2026-53762)

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cryptographic implementation in the wolfCrypt backend when deriving SHA-256 and SHA-512 volume header keys. A remote attacker can obtain an encrypted container, disk image, or volume header and perform offline password guessing to disclose sensitive information.

Only non-default builds made with the opt-in WOLFCRYPT=1 configuration are vulnerable. Official precompiled binaries and usual distribution packages are unaffected.

Remediation

Install update from vendor's website.

References

• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-jjcr-75w7-58jp
• https://github.com/VeraCrypt/VeraCrypt/commit/579ce2fd31f01b0befba947ed863ed1d5e4be3f0
• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-94c6-mgmv-mqc5