CVE-2026-77572

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77572
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77572.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77572
Aliases
  • GHSA-9mgv-w2fw-3m78
Published
2026-10-14T15:26:31Z
Modified
2026-10-28T11:17:52Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt
Details

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible .\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77572.json"
}
References

Affected packages

Git / github.com/veracrypt/veracrypt

Affected ranges

Type
GIT
Repo
https://github.com/veracrypt/veracrypt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ca35405421df549e75f1f241259bdda0c5b67d40
Fixed
d26216c294fdfb090ee856f6195c294176defa1d
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.26.29"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "ca35405421df549e75f1f241259bdda0c5b67d40"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "VeraCrypt_1.26.29",
            "range": [
                {
                    "fixed": "d26216c294fdfb090ee856f6195c294176defa1d"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

VeraCrypt_1.*
VeraCrypt_1.0a
VeraCrypt_1.0b
VeraCrypt_1.0c
VeraCrypt_1.0d
VeraCrypt_1.0e
VeraCrypt_1.0f
VeraCrypt_1.0f-1
VeraCrypt_1.0f-2
VeraCrypt_1.0f-BETA
VeraCrypt_1.0f-BETA2
VeraCrypt_1.0f-BETA3
VeraCrypt_1.12
VeraCrypt_1.13
VeraCrypt_1.14
VeraCrypt_1.15
VeraCrypt_1.16
VeraCrypt_1.17
VeraCrypt_1.18
VeraCrypt_1.18_PreRelease
VeraCrypt_1.18a
VeraCrypt_1.19
VeraCrypt_1.20
VeraCrypt_1.21
VeraCrypt_1.22
VeraCrypt_1.23
VeraCrypt_1.24
VeraCrypt_1.24-Hotfix1
VeraCrypt_1.24-Update2
VeraCrypt_1.24-Update3
VeraCrypt_1.24-Update4
VeraCrypt_1.24-Update5
VeraCrypt_1.24-Update6
VeraCrypt_1.24-Update7
VeraCrypt_1.24-Update8_MacOSX
VeraCrypt_1.25.4
VeraCrypt_1.25.7
VeraCrypt_1.25.9
VeraCrypt_1.26.14
VeraCrypt_1.26.15
VeraCrypt_1.26.18
VeraCrypt_1.26.19
VeraCrypt_1.26.20
VeraCrypt_1.26.24
VeraCrypt_1.26.28_Beta
VeraCrypt_1.26.28_Beta2
VeraCrypt_1.26.28_Beta3
VeraCrypt_1.26.28_Beta4
VeraCrypt_1.26.6
VeraCrypt_1.26.7
VeraCrypt_Linux_1.*
VeraCrypt_Linux_1.0d
VeraCrypt_Linux_1.0e
VeraCrypt_Linux_1.0f-BETA
VeraCrypt_MacOSX_1.*
VeraCrypt_MacOSX_1.0d
VeraCrypt_MacOSX_1.0e
VeraCrypt_MacOSX_1.0f-BETA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77572.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "126800762443294855587670794210355240933",
                "47597020456126895460719210250240078062",
                "265562537285236042747599561066341173782",
                "94589067323535375925123756840258437995",
                "293598954902022003549830386972229142541",
                "270463003947387685498046472829295604796",
                "43061991315656686439208006581336062358",
                "155607886639273837041227464146972866811",
                "63574685394783255339695631599908114732",
                "243901264921048893383007334836439053616",
                "44702070837057286659559664145814068636",
                "193472928738452296311627363564151831851",
                "253123046556730340484656729175772104775",
                "160974694050816889125584081002064633782",
                "57457704845055316182593660535480560053",
                "181550636794313942491538525433829355501",
                "237780882994622816520686035207233520532",
                "71937560664369072825159641646287120515",
                "62629418952320185546480451412126447086",
                "21938374888144078731894511850805218108",
                "224027027322442416793727019886862821643",
                "278870295686143431333299333802055008289",
                "25621229782126785511615917907602202380",
                "223458712990292475332715536030557916724",
                "336861665789197580152689407845271529680",
                "72347953408284222520331656090186688157",
                "118075979095065896487243688443372660691",
                "61214652164742092246169582995137011318",
                "236323893325230724405018434370770957690",
                "185243640214519744887149270153964127447",
                "268202483658319568318177930900047378259",
                "104129329100258378116944876446620679998",
                "295147199402856683328773472330058884965",
                "69279854170085441236445789851383484917",
                "259983845947569702648909177747722958258",
                "86872988846087530793311114594638137619",
                "220908958296003782678631555516056809385",
                "186419163605797372196990263917482272931",
                "279307863130534379534602952325722014383",
                "296992612728593392181364492161315125864",
                "51919008344160718424082396324551488181",
                "51342233978503689628459163467577184786",
                "227165630220284112323309235750029731361",
                "315908696376872669621576837488171789263",
                "77924088252981263320237003889872974456",
                "118150523675559411247211097528944369355",
                "207915823539573032155384786450812021044",
                "282577245146611293122456192968438012550",
                "187827686648303113308972693482140035729",
                "140040342638619620137718942070939713903",
                "34855631697549770159353462618812997556",
                "253372027608028990162606137753980297141"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-77572-29961c9a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/ca35405421df549e75f1f241259bdda0c5b67d40",
        "target": {
            "file": "src/Driver/Ntdriver.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "258895734543220622509488683031991196403",
            "length": 492
        },
        "id": "CVE-2026-77572-42270a36",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/ca35405421df549e75f1f241259bdda0c5b67d40",
        "target": {
            "file": "src/Driver/Ntdriver.c",
            "function": "SymbolicLinkToTarget"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41377907125657021388192510331637000199",
            "length": 25686
        },
        "id": "CVE-2026-77572-5554943e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/veracrypt/veracrypt/commit/ca35405421df549e75f1f241259bdda0c5b67d40",
        "target": {
            "file": "src/Driver/Ntdriver.c",
            "function": "ProcessMainDeviceControlIrp"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:17:52Z"