CVE-2015-7359

The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, do not check the impersonation level of impersonation tokens, which allows local users to impersonate a user at SecurityIdentify level and gain access to other users' mounted encrypted volumes.

• CWE-264

• http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2015/09/22/7Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/24/3Issue Tracking, Mailing List, Third Party Advisory
• https://code.google.com/p/google-security-research/issues/detail?id=537Issue Tracking, Third Party Advisory
• https://veracrypt.codeplex.com/wikipage?title=Release%20NotesRelease Notes, Vendor Advisory
• http://packetstormsecurity.com/files/133877/Truecrypt-7-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2015/09/22/7Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/09/24/3Issue Tracking, Mailing List, Third Party Advisory
• https://code.google.com/p/google-security-research/issues/detail?id=537Issue Tracking, Third Party Advisory
• https://veracrypt.codeplex.com/wikipage?title=Release%20NotesRelease Notes, Vendor Advisory

Published

Oct 3, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7346SQL injection vulnerability in ZCMS 1.1.
• CVE-2015-7347Cross-site scripting (XSS) vulnerability in ZCMS JavaServer …
• CVE-2015-7348Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 a…
• CVE-2015-7349Cross-site scripting (XSS) vulnerability in the sample feedb…
• CVE-2015-7357Cross-site scripting (XSS) vulnerability in the uDesign (aka…
• CVE-2015-7358The IsDriveLetterAvailable method in Driver/Ntdriver.c in Tr…
• CVE-2015-7360Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2015-7361FortiOS 5.2.3, when configured to use High Availability (HA)…
• CVE-2015-7362Fortinet FortiClient Linux SSLVPN before build 2313, when in…
• CVE-2015-7363Cross-site scripting (XSS) vulnerability in the advanced set…
• CVE-2015-7364The HTML_Quickform library, as used in Revive Adserver befor…
• CVE-2015-7365Cross-site scripting (XSS) vulnerability in the plugin upgra…