CVE-2026-108982

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108982
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108982.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108982
Published
2026-10-12T02:44:04Z
Modified
2026-10-14T02:30:18Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-459"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108982.json"
}
References

Affected packages

Git / github.com/veracrypt/veracrypt

Affected ranges

Type
GIT
Repo
https://github.com/veracrypt/veracrypt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d26216c294fdfb090ee856f6195c294176defa1d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.26.29"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

VeraCrypt_1.*
VeraCrypt_1.0a
VeraCrypt_1.0b
VeraCrypt_1.0c
VeraCrypt_1.0d
VeraCrypt_1.0e
VeraCrypt_1.0f
VeraCrypt_1.0f-1
VeraCrypt_1.0f-2
VeraCrypt_1.0f-BETA
VeraCrypt_1.0f-BETA2
VeraCrypt_1.0f-BETA3
VeraCrypt_1.12
VeraCrypt_1.13
VeraCrypt_1.14
VeraCrypt_1.15
VeraCrypt_1.16
VeraCrypt_1.17
VeraCrypt_1.18
VeraCrypt_1.18_PreRelease
VeraCrypt_1.18a
VeraCrypt_1.19
VeraCrypt_1.20
VeraCrypt_1.21
VeraCrypt_1.22
VeraCrypt_1.23
VeraCrypt_1.24
VeraCrypt_1.24-Hotfix1
VeraCrypt_1.24-Update2
VeraCrypt_1.24-Update3
VeraCrypt_1.24-Update4
VeraCrypt_1.24-Update5
VeraCrypt_1.24-Update6
VeraCrypt_1.24-Update7
VeraCrypt_1.24-Update8_MacOSX
VeraCrypt_1.25.4
VeraCrypt_1.25.7
VeraCrypt_1.25.9
VeraCrypt_1.26.14
VeraCrypt_1.26.15
VeraCrypt_1.26.18
VeraCrypt_1.26.19
VeraCrypt_1.26.20
VeraCrypt_1.26.24
VeraCrypt_1.26.28_Beta
VeraCrypt_1.26.28_Beta2
VeraCrypt_1.26.28_Beta3
VeraCrypt_1.26.28_Beta4
VeraCrypt_1.26.6
VeraCrypt_1.26.7
VeraCrypt_Linux_1.*
VeraCrypt_Linux_1.0d
VeraCrypt_Linux_1.0e
VeraCrypt_Linux_1.0f-BETA
VeraCrypt_MacOSX_1.*
VeraCrypt_MacOSX_1.0d
VeraCrypt_MacOSX_1.0e
VeraCrypt_MacOSX_1.0f-BETA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108982.json"