CVE-2015-7358

The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.

• CWE-264

• http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2015/09/22/7Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/24/3Issue Tracking, Mailing List, Third Party Advisory
• https://code.google.com/p/google-security-research/issues/detail?id=538Third Party Advisory
• https://veracrypt.codeplex.com/wikipage?title=Release%20NotesRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/38403/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2015/09/22/7Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/24/3Issue Tracking, Mailing List, Third Party Advisory
• https://code.google.com/p/google-security-research/issues/detail?id=538Third Party Advisory
• https://veracrypt.codeplex.com/wikipage?title=Release%20NotesRelease Notes, Vendor Advisory
• https://www.exploit-db.com/exploits/38403/Third Party Advisory, VDB Entry

Published

Oct 3, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7344HikaShop Joomla Component before 2.6.0 has XSS via an inject…4.8
• CVE-2015-7346SQL injection vulnerability in ZCMS 1.1.
• CVE-2015-7347Cross-site scripting (XSS) vulnerability in ZCMS JavaServer …
• CVE-2015-7348Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 a…
• CVE-2015-7349Cross-site scripting (XSS) vulnerability in the sample feedb…
• CVE-2015-7357Cross-site scripting (XSS) vulnerability in the uDesign (aka…
• CVE-2015-7359The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice …
• CVE-2015-7360Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2015-7361FortiOS 5.2.3, when configured to use High Availability (HA)…
• CVE-2015-7362Fortinet FortiClient Linux SSLVPN before build 2313, when in…
• CVE-2015-7363Cross-site scripting (XSS) vulnerability in the advanced set…
• CVE-2015-7364The HTML_Quickform library, as used in Revive Adserver befor…