Description
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size can overflow the heap allocation. VolumePassword::Deserialize accepts PasswordSize values larger than the fixed 128-byte PasswordBuffer, allowing downstream DataPtr() and Size() consumers such as the KDF to read beyond the buffer. DeserializeString, DeserializeWString, and the string and wide-string list readers also lack allocation and collection bounds, which can exhaust memory, and a zero-length DeserializeString can access an empty vector. Windows uses a different path, and the immediate CoreService pipe writer is the same-user parent process, so the documented exposure is a local defense-in-depth boundary rather than a remote attack. This issue is fixed in 1.26.30.
Published: 2026-11-04
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Local heap overflow and out-of-bounds read affecting VeraCrypt CoreService
Action: Immediate Patch
AI Analysis

Impact

VeraCrypt versions earlier than 1.26.30 deserialize data without validating length and count fields when processing requests from user‑supplied GUI or CLI. The deserializer allocates a buffer that is smaller than the amount of data it reads, producing a heap overflow and an out‑of‑bounds read. This memory corruption occurs in the CoreService helper, which runs with elevated privileges. The impact could include corruption of the CoreService process or denial of service; however, the analysis infers that an attacker might be able to manipulate the CoreService or execute code, but this has not been directly demonstrated. The vulnerability is a classic example of CWE‑125 and CWE‑787.

Affected Systems

The affected product is VeraCrypt. Unix, macOS, and FreeBSD builds of VeraCrypt versions 1.26.29 and earlier are vulnerable. The flaw lies in the serialization paths used when data is transmitted from the unprivileged user interface to the privileged CoreService helper. Windows uses a different code path and is not affected by this specific issue.

Risk and Exploitability

The CVSS score of 8.8 indicates High severity. Because the attack requires local interaction with the CoreService helper and involves manipulating untrusted user data, the primary risk is for local privilege escalation or denial of service. The EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. It is inferred that the likely attack vector is local. The analysis infers that exploitation would likely involve a malicious user or process submitting crafted serialized data to trigger the overflow, potentially corrupting CoreService memory or causing a crash that interrupts encryption operations.

Generated by OpenCVE AI on November 5, 2026 at 00:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade VeraCrypt to version 1.26.30 or newer to apply the corrected serialization logic.
  • Restrict write permissions on the CoreService pipe so that only trusted users or processes can send serialized input.
  • Monitor CoreService logs for deserialization errors or unusual memory consumption to detect attempted exploitation.

Generated by OpenCVE AI on November 5, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Veracrypt
Veracrypt veracrypt
Vendors & Products Veracrypt
Veracrypt veracrypt

Wed, 04 Nov 2026 23:00:00 +0000

Type Values Removed Values Added
Description VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size can overflow the heap allocation. VolumePassword::Deserialize accepts PasswordSize values larger than the fixed 128-byte PasswordBuffer, allowing downstream DataPtr() and Size() consumers such as the KDF to read beyond the buffer. DeserializeString, DeserializeWString, and the string and wide-string list readers also lack allocation and collection bounds, which can exhaust memory, and a zero-length DeserializeString can access an empty vector. Windows uses a different path, and the immediate CoreService pipe writer is the same-user parent process, so the documented exposure is a local defense-in-depth boundary rather than a remote attack. This issue is fixed in 1.26.30.
Title VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)
Weaknesses CWE-125
CWE-787
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Veracrypt Veracrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-04T22:53:57.172Z

Reserved: 2026-08-20T19:36:13.805Z

Link: CVE-2026-77372

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T23:17:58.713

Modified: 2026-11-04T23:17:58.713

Link: CVE-2026-77372

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T01:00:17Z

Weaknesses