CVE-2026-54073

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54073

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54073.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54073

Aliases

GHSA-jjcr-75w7-58jp

Published

2026-08-21T18:51:58Z

Modified

2026-08-24T03:59:08Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

VeraCrypt: Hidden volume quick format weakens plausible deniability

Details

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54073.json"
}

References

Affected packages

Git / github.com/veracrypt/veracrypt

Affected ranges

Type

GIT

Repo

https://github.com/veracrypt/veracrypt

Events

Introduced

81c87a8f0b37fb82bb9c501fd77bd30ede8f7e55

Fixed

689a59cd584f090ca5f9214d5f2f3a9eac499e53

Fixed

d26216c294fdfb090ee856f6195c294176defa1d

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.26.6"
        },
        {
            "fixed": "1.26.29"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

VeraCrypt_1.*

VeraCrypt_1.26.14

VeraCrypt_1.26.15

VeraCrypt_1.26.18

VeraCrypt_1.26.19

VeraCrypt_1.26.20

VeraCrypt_1.26.24

VeraCrypt_1.26.28_Beta

VeraCrypt_1.26.28_Beta2

VeraCrypt_1.26.28_Beta3

VeraCrypt_1.26.28_Beta4

VeraCrypt_1.26.6

VeraCrypt_1.26.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54073.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "92171933927197961515389020930267001188",
                "132904287086057484570412502959286911530",
                "301181098980801184912981558467226939055",
                "15611546946528061232772561396959361429",
                "309273267025978046025875075828143184672",
                "226430422018809413567878358608823269739",
                "262947426654504702425018531999856460493",
                "228700118831507050528860526903402481079",
                "4779630183274777428414595869623320926"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54073-10e654a6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53",
        "target": {
            "file": "src/Common/Format.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "29569041090128046360526361220077446245",
            "length": 6341
        },
        "id": "CVE-2026-54073-21fcbbd1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53",
        "target": {
            "file": "src/Common/Fat.c",
            "function": "FormatFat"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "285150722962346143196378931730454015125",
            "length": 3694
        },
        "id": "CVE-2026-54073-4359e4bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53",
        "target": {
            "file": "src/Common/Format.c",
            "function": "FormatNoFs"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "157543543040711159357476676819399173838",
                "58883383273148556658216499824720202306",
                "301181098980801184912981558467226939055",
                "4890879444123927290086105854351220260",
                "31704301834254403771041317530090972411",
                "301248300633020546627820581623789560015",
                "250308709282672653288390229415662451611",
                "89939479945270547154522993489020094762",
                "257523527911073727886112263374760499525",
                "259879843646212860426416705828249054051",
                "163684169697837680246085812728720321363"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54073-b361d9fa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53",
        "target": {
            "file": "src/Common/Fat.c"
        }
    }
]

vanir_signatures_modified

"2026-08-24T03:59:08Z"