CVE-2026-54073

VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.

• CWE-693

• https://github.com/veracrypt/VeraCrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53
• https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29
• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-jjcr-75w7-58jp
• https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-jjcr-75w7-58jp

Published

Aug 21, 2026

Last Modified

Sep 25, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54068SiYuan is an open-source personal knowledge management syste…5.9
• CVE-2026-54069SiYuan is an open-source personal knowledge management syste…9.2
• CVE-2026-5407SMB2 protocol dissector infinite loop in Wireshark 4.6.0 to …5.5
• CVE-2026-54070SiYuan is an open-source personal knowledge management syste…7.1
• CVE-2026-54071BabelDOC is a document translation tool. Prior to 0.6.3, Bab…7.8
• CVE-2026-54072Authorizer is an open-source, self-hostable authentication a…9.3
• CVE-2026-54074Tina is a headless content management system. @tinacms/cli v…7.8
• CVE-2026-54076ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for…8.1
• CVE-2026-54077ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT …7.1
• CVE-2026-54078veraPDF validation model is an implementation of the veraPDF…8.7
• CVE-2026-54079veraPDF validation provides PDF/A and PDF/UA validation, fea…8.7
• CVE-2026-5408BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5