CVE-2026-77572
Description
A flaw was found in VeraCrypt. The Windows driver accepts caller-supplied device and object paths that are broader than necessary for normal operations. A local user can exploit this vulnerability by sending specific control requests to the driver, causing it to perform privileged system lookups outside of the intended scope. This issue can lead to information disclosure, exposing system details such as drive partition layouts, disk geometry, and internal path metadata.
Statement
Low impact is assigned to this flaw because it requires authenticated local access and only exposes non-sensitive storage geometry and partition layout metadata without permitting privilege escalation or data alteration. Additionally, this vulnerability is confined to the third-party Windows platform driver, meaning Red Hat Enterprise Linux and other Red Hat offerings do not ship or support the affected software.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories
The application can operate on unexpected files, such as system files or configuration files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
