CVE-2026-53762

Name of the Vulnerable Software and Affected Versions VeraCrypt versions prior to 1.26.29

Description Non-default builds created with WOLFCRYPT=1 and WOLFCRYPT BACKEND route SHA-256 and SHA-512 volume-header key derivation through the derive key sha256() and derive key sha512() functions in src/Crypto/wolfCrypt.c. In these builds, the configured iterations value is discarded and wc HKDF (a HMAC-based Extract-and-Expand Key Derivation Function) is used instead of PBKDF2-HMAC. Consequently, changing the PIM or iteration count does not increase the derivation cost, which allows an attacker with access to an affected container, disk image, or volume header to perform offline password guesses more efficiently.

Recommendations Update to version 1.26.29. Volumes created by an affected WOLFCRYPT=1 build must be backed up and recreated, as corrected builds derive different keys.