CVE-2026-77572 veracrypt CVE debrief

Who should care

System administrators and users of VeraCrypt on Windows systems should verify their version and apply updates if necessary to prevent local users from accessing sensitive disk information.

Why it matters

VeraCrypt vulnerability CVE-2026-77572 allows local users to access sensitive disk information via IOCTL handlers in versions 1.26.29 and earlier, requiring verification and potential updates to prevent exploitation.

• Local users can access low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.
• Verify VeraCrypt version and apply updates to prevent exploitation.
• Restrict access to the .VeraCrypt device to authorized users only to limit exposure.

Technical summary

VeraCrypt's veracrypt.sys IOCTL handlers in versions 1.26.29 and earlier do not properly authorize caller-supplied object-manager and device paths, allowing a local user to access sensitive disk information. This vulnerability can be exploited by a local user to disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata. The vulnerability requires verification and potential updates to prevent exploitation. Affected systems should be updated to prevent unauthorized access to sensitive disk information.

Defensive priority

Verify and apply VeraCrypt updates; restrict access to the .VeraCrypt device; monitor for suspicious IOCTL requests

Recommended defensive actions

• Verify VeraCrypt version and apply updates if necessary
• Restrict access to the .VeraCrypt device to authorized users only
• Monitor system logs for suspicious IOCTL requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and VeraCrypt source references provide details on the vulnerability and affected versions. The CVE record was published on 2026-10-14T15:26:31.329Z and has not been modified since then. Evidence is limited to publicly available information from the CVE Program and VeraCrypt sources. Defenders should verify VeraCrypt version and apply updates if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.