CVE-2026-54073

VeraCrypt: Hidden volume quick format weakens plausible deniability

Published Aug 21, 2026 CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Description

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

Analysis

Technical impact

VeraCrypt’s hidden volume creation function used quick format from version 1.26.6 to 1.26.29, writing raw zeroed sectors at 128 MiB intervals. These writes bypass the normal encrypted data unit path and leave deterministic plaintext markers where random ciphertext should exist. While the markers do not expose hidden‑volume contents or degrade encryption strength, they undermine plausible deniability by giving forensic analysts identifiable patterns to detect hidden volumes.

Affected Systems

The affected product is VeraCrypt. Versions from 1.26.6 through 1.26.28 contain the issue; the problem is corrected in release 1.26.29 and later.

Risk and Exploitability

The vulnerability has a CVSS score of 4.6, indicating moderate severity. No EPSS score is available and the issue is not listed in CISA KEV. The attack vector is inferred from the description because the hidden volume creation requires local user interaction on a file‑hosted container. An attacker cannot obtain confidential data or execute code; the risk is limited to forensic visibility and loss of plausible deniability under investigative circumstances.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

veracrypt

VeraCrypt

affected

Version	Status	Constraints
`>= 1.26.6, < 1.26.29`	affected	—

No data.

Vendor Product Versions

Veracrypt

Version	Status	Scheme	Platform
`[1.26.6,1.26.29)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade VeraCrypt to version 1.26.29 or newer.
If any hidden volumes were created in the affected period, recreate them after the upgrade to eliminate deterministic markers.
Ensure future hidden‑volume creations use the updated application version to benefit from the fixed formatting routine.

Generated by OpenCVE AI on August 21, 2026 at 21:06 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.141% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/veracrypt/VeraCrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53
https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29
https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-jjcr-75w7-58jp

History

Aug 21, 2026 9:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Veracrypt Veracrypt veracrypt
Vendors & Products		Veracrypt Veracrypt veracrypt

Aug 21, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 7:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.
Title		VeraCrypt: Hidden volume quick format weakens plausible deniability
Weaknesses		CWE-693
References		https://github.com/veracrypt/VeraCrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53 https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-jjcr-75w7-58jp
Metrics		cvssV4_0 `{'score': 4.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`