{"id":"CVE-2026-77372","kind":"vulnerability","aliases":["CVE-2026-77372"],"related":[],"title":"VeraCrypt: crafted serialized input overflows heap in root helper","description":"VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size can overflow the heap allocation. VolumePassword::Deserialize accepts PasswordSize values larger than the fixed 128-byte PasswordBuffer, allowing downstream DataPtr() and Size() consumers such as the KDF to read beyond the buffer. DeserializeString, DeserializeWString, and the string and wide-string list readers also lack allocation and collection bounds, which can exhaust memory, and a zero-length DeserializeString can access an empty vector. Windows uses a different path, and the immediate CoreService pipe writer is the same-user parent process, so the documented exposure is a local defense-in-depth boundary rather than a remote attack. This issue is fixed in 1.26.30.","summary":"VeraCrypt's Unix, macOS and FreeBSD code that passes data from the unprivileged GUI or CLI to the root CoreService helper accepts unchecked length and count values, so a non-aligned string size can overflow a heap buffer and an oversized password size can read past a fixed 128-byte buffer. An attacker who can feed that boundary could crash the helper, exhaust memory, or read adjacent memory in a privileged process.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disk-encryption","freebsd","linux","macos","package","veracrypt"],"not_affected_if":["version-1.26.30-or-later","windows-only"],"how_to_check":"- Check the installed VeraCrypt version with `veracrypt --version` on Linux or macOS, or the About dialog in the GUI.\n- Look for the CoreService helper running as root on Unix, macOS or FreeBSD systems where VeraCrypt is installed.","fix":"- VeraCrypt: move to `1.26.30` or later.","status":"open","published_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:31:42+00:00","updated_at":"2026-11-05T00:31:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T00:31:42Z","model":"claude-haiku-5-5","output":{"fix":"- VeraCrypt: move to `1.26.30` or later.","reach":"local","title":"VeraCrypt: crafted serialized input overflows heap in root helper","impact":"high","summary":"VeraCrypt's Unix, macOS and FreeBSD code that passes data from the unprivileged GUI or CLI to the root CoreService helper accepts unchecked length and count values, so a non-aligned string size can overflow a heap buffer and an oversized password size can read past a fixed 128-byte buffer. An attacker who can feed that boundary could crash the helper, exhaust memory, or read adjacent memory in a privileged process.","audience":"businesses","category":"package","nicknames":[],"who_cares":["veracrypt","macos","linux","freebsd","disk-encryption"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Local user escalates or crashes the root CoreService helper process.","analyst_note":"","how_to_check":"- Check the installed VeraCrypt version with `veracrypt --version` on Linux or macOS, or the About dialog in the GUI.\n- Look for the CoreService helper running as root on Unix, macOS or FreeBSD systems where VeraCrypt is installed.","plain_action":"","needs_analyst":false,"not_affected_if":["windows-only","version-1.26.30-or-later"],"who_is_affected":"Machines running VeraCrypt on Unix, macOS or FreeBSD, where the unprivileged GUI or CLI talks to the root CoreService helper. The sources say Windows uses a different path, and that the documented exposure is a local boundary because the pipe writer is the same-user parent process, so remote attack is not the stated risk. Systems running only Windows builds can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000781,"input_tokens":4575,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-77372':12A,15A '1.26.30':109C,267C '128':73B,177C 'accept':45B,121C,170C 'access':223C 'adjac':91B 'align':55B,161C 'alloc':146C,167C,208C 'allow':180C 'also':206C 'attack':77B,261C 'base':104C 'beyond':192C 'bound':211C 'boundari':82B,256C 'buffer':62B,75B,194C 'byte':74B,156C,178C 'cli':39B,138C 'code':30B 'collect':210C 'consum':185C 'coreservic':43B,142C,235C 'could':83B 'count':49B,125C 'craft':2A 'crash':84B 'cross':132C 'cve':10A,13A 'data':33B,129C 'dataptr':182C 'defens':253C 'defense-in-depth':252C 'depth':255C 'deseri':128C,169C 'deserializestr':195C,221C 'deserializewstr':145C,196C 'differ':230C 'disk':17B,99C 'disk-encrypt':16B 'document':247C 'downstream':181C 'element':152C 'empti':225C 'encrypt':18B,100C 'exhaust':87B,214C 'exposur':248C 'feed':80B 'fix':72B,176C,265C 'floor':147C 'freebsd':19B,29B,114C 'gui':37B,136C 'heap':6A,61B,166C 'helper':9A,44B,86B,143C 'immedi':234C 'input':4A 'issu':263C 'kdf':189C 'lack':207C 'larger':173C 'length':47B,123C,220C 'linux':20B 'list':204C 'local':251C 'maco':21B,27B,112C 'memori':88B,92B,215C 'non':54B,160C 'non-align':53B,159C 'overflow':5A,59B,164C 'overs':65B 'packag':22B 'parent':243C 'pass':32B 'password':66B 'passwordbuff':179C 'passwords':171C 'past':70B 'path':116C,231C 'pipe':236C 'prior':107C 'privileg':95B 'process':96B,244C 'provid':98C 'rather':257C 'read':69B,90B,154C,191C 'reader':205C 'remot':260C 'root':8A,42B,141C 'same-us':240C 'secur':103C 'serial':3A,115C,144C 'size':57B,67B,148C,155C,162C,184C 'sizeof':149C 'src/platform/serializer.cpp':118C 'src/volume/volumepassword.cpp':120C 'string':56B,199C,203C 'strong':102C 'truecrypt':106C 'uncheck':46B 'unix':26B,111C 'unprivileg':36B,135C 'untrust':122C 'use':228C 'user':242C 'valu':50B,126C,172C 'vector':226C 'veracrypt':1A,23B,24B,97C 'volumepassword':168C 'wchar':150C 'wide':202C 'wide-str':201C 'window':227C 'writer':237C 'zero':219C 'zero-length':218C","nicknames":[],"mitigations":[],"who_affected":"Machines running VeraCrypt on Unix, macOS or FreeBSD, where the unprivileged GUI or CLI talks to the root CoreService helper. The sources say Windows uses a different path, and that the documented exposure is a local boundary because the pipe writer is the same-user parent process, so remote attack is not the stated risk. Systems running only Windows builds can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["diskencryption","freebsd","high","linux","macos","package","veracrypt"],"campaign_type":null,"first_public_at":"2026-10-17T08:59:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77372","severity":null,"published_at":"2026-11-04T23:17:58+00:00","modified_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71498,"url":"https://github.com/veracrypt/VeraCrypt/commit/fb9d96c52dace4d34c5427402b512e8de5f832d6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71499,"url":"https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.30","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71500,"url":"https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-4j3p-7hp7-xw73","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-17T08:59:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}