Description
VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \.\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.
Published: 2026-10-14
Score: 3.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

VeraCrypt’s Windows driver exposes several metadata IOCTLs that accept user-supplied strings beyond intended bounds. A local user who can open the \\.\VeraCrypt device can invoke these handlers and cause the kernel to perform symbolic‑link and disk‑device lookups outside the intended path scope, revealing low‑sensitivity drive‑letter targets, partition information, disk geometry, and GPT/MBR state. This results in information disclosure about the system’s disk topology.

Affected Systems

The affected product is any VeraCrypt version 1.26.29 or earlier. All installations that expose the \\.\VeraCrypt device to local users are vulnerable.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. A local attacker with access to the \\.\VeraCrypt device can send the listed IOCTLs and view the returned metadata, but the information disclosed is low sensitivity and requires local access. No escalation to higher privileges is possible through this flaw.

Generated by OpenCVE AI on October 15, 2026 at 19:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a firmware or driver update to VeraCrypt 1.26.30 (or newer) where the missing authorization checks are fixed.
  • Remove local users’ rights to open the \\.\VeraCrypt device by adjusting NTFS permissions or applying a Local Security Policy that restricts device access to administrators only.
  • Enable audit logging or a lightweight firewall rule to detect and record any unexpected calls to the TC_IOCTL_* or VC_IOCTL_* IOCTLs on the VeraCrypt device, enabling timely incident response.

Generated by OpenCVE AI on October 15, 2026 at 19:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Veracrypt
Veracrypt veracrypt
Vendors & Products Veracrypt
Veracrypt veracrypt

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \.\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.
Title VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Veracrypt Veracrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T15:08:14.109Z

Reserved: 2026-08-20T20:35:30.147Z

Link: CVE-2026-77572

cve-icon Vulnrichment

Updated: 2026-10-14T16:11:27.597Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T16:17:53.863

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-77572

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T05:15:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor