When VeraCrypt is compiled with the WOLFCRYPT=1 option the build ignores any user‑defined PBKDF2 iteration count and replaces PBKDF2‑HMAC with the HKDF function. This means that the derivation of the volume‑header key is performed with a fixed, low iteration count, making a brute‑force attack on the password considerably cheaper than intended.

The flaw is limited to VeraCrypt releases before 1.26.29 that were built with WOLFCRYPT=1 and the WOLFCRYPT_BACKEND route for key derivation. Official binaries that use the standard PBKDF2 backend are not impacted. Volumes created with the affected build must be backed up and recreated because the key derived in later versions will differ.

With a CVSS score of 6.2 the vulnerability is of moderate severity. EPSS information is not available and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation data does not exist yet. However, anyone who obtains an encrypted container from a V 1.26.28 or earlier build compiled with WOLFCRYPT=1 can conduct a much faster offline password‑guessing attack. The attack requires possession of the container and cannot be performed remotely, so the risk is moderate but significant for existing compromised volumes.