CVE-2026-77372

Name of the Vulnerable Software and Affected Versions VeraCrypt versions prior to 1.26.30

Description Serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp for Unix, macOS, and FreeBSD accept untrusted length and count values during data deserialization between the unprivileged GUI or CLI and the root CoreService helper. Specifically, the DeserializeWString() function in Serializer allocates elements based on a calculation that can lead to a heap overflow if the size is non-aligned. Additionally, VolumePassword::Deserialize accepts PasswordSize values exceeding the 128-byte PasswordBuffer, enabling the Key Derivation Function (KDF) to read beyond the buffer. The DeserializeString() and DeserializeWString() functions, along with string and wide-string list readers, lack allocation and collection bounds, which may result in memory exhaustion. Furthermore, a zero-length DeserializeString() can lead to access of an empty vector.

Recommendations Update to version 1.26.30.