The flaw in VeraCrypt 1.26.29’s FUSE‑T build keeps its auxiliary FUSE‑T service (go-nfsv4) and the core-service helper alive after a volume is reported as dismounted. The stale mount still serves the decrypted volume image over an SMB loopback session, and the helper retains a handle to the raw device. A local user can therefore remount the volume or access the decrypted data without supplying the passphrase, for example by reopening a path from the Open Recent menu or attaching the stale volume.dmg file. Because the data remains in decrypted form, confidentiality is effectively lost for any such user.

Affected products are the IDRIX VeraCrypt FUSE-T build, version 1.26.29 running on macOS. The macFUSE build of VeraCrypt is not impacted and provides a safe alternative. No other versions or vendors are mentioned.

The fix is rated CVSS 7.2, indicating a high severity with potential for unauthorized data disclosure. The EPSS score is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not identified in the CISA KEV catalog. The issue requires local privileges; a malicious or curious local process can exploit the lingering processes once a volume has been dismounted. The attacker must have read access to the machine and the ability to execute commands to kill or attach the stale SMB share, which is typical for a user-level process on macOS. Based on the description, the likely attack vector is local.