VeraCrypt deserialization heap overflow and out-of-bounds read
A user on the same PC can make the disk encryption program crash or be breached.
Summary
Before 1.26.30, VeraCrypt's Unix, macOS, and FreeBSD deserialization paths accept untrusted length and count values, which can overflow memory or read beyond a buffer. The exposure is local, from the same machine's users, not a remote attack.
Affected when
- Unix, macOS, or FreeBSD builds (not Windows)
What to do
Update to VeraCrypt 1.26.30.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen