CVE-2026-53762

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-256 and SHA-512 volume-header key derivation through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c, where the configured iterations value is discarded and wc_HKDF is used instead of PBKDF2-HMAC. Changing the PIM or iteration count therefore does not increase derivation cost, allowing an attacker with an affected container, disk image, or volume header to perform substantially cheaper offline password guesses. Official precompiled VeraCrypt binaries and normal distribution packages use the standard PBKDF2 backend and are not affected. Volumes created by an affected WOLFCRYPT=1 build require backup and recreation because corrected builds derive different keys. This issue is fixed in version 1.26.29.

• CWE-916

• https://github.com/veracrypt/VeraCrypt/commit/39f93910075e1cf492fcf4a9f99a53c7d0b96b87
• https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29
• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-94c6-mgmv-mqc5
• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-94c6-mgmv-mqc5

Published

Aug 21, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53757Emlog is an open source website building system. In versions…6.9
• CVE-2026-53758Emlog is an open source website building system. In versions…8.7
• CVE-2026-53759linuxfabrik-lib provides Python modules for database access,…2
• CVE-2026-5376An issue that could prevent session inactivity timeouts from…5.9
• CVE-2026-53760Admidio is an open-source user management solution. In versi…5.2
• CVE-2026-53761Frappe CRM is an open-source customer relationship managemen…8.2
• CVE-2026-53763OP-TEE is a Trusted Execution Environment (TEE) designed as …3.8
• CVE-2026-53765Chrome DevTools for agents (chrome-devtools-mcp) lets your c…6.1
• CVE-2026-53766Chrome DevTools for agents (chrome-devtools-mcp) lets your c…6.1
• CVE-2026-53769Avo is a framework to create admin panels for Ruby on Rails …6.5
• CVE-2026-5377GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-53776Perry before 0.5.1166 contains a JWT validation vulnerabilit…9.3