CyberRota Analysis
AI-GeneratedVeraCrypt versions 1.26.6 to 1.26.29 have a vulnerability in the hidden volume creation process that results in predictable plaintext markers being written to disk, potentially undermining the plausible deniability of hidden volumes during forensic analysis. While this does not expose the content of the hidden volumes or compromise the encryption strength, it could be a concern for users relying on VeraCrypt for sensitive data protection. Organizations and individuals using affected versions should prioritize upgrading to version 1.26.29 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.