CVE-2026-53762: VeraCrypt WOLFCRYPT Key Derivation Flaw

CVE-2026-53762 Overview

CVE-2026-53762 affects VeraCrypt disk encryption software when built with the non-default WOLFCRYPT=1 and WOLFCRYPT_BACKEND compile-time options. In these builds, SHA-256 and SHA-512 volume-header key derivation is routed through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c. The configured iteration count is discarded, and wc_HKDF is called in place of PBKDF2-HMAC. Changing the Personal Iterations Multiplier (PIM) or iteration count no longer increases derivation cost, enabling substantially cheaper offline password guessing against affected containers, disk images, or volume headers. This weakness maps to [CWE-916: Use of Password Hash With Insufficient Computational Effort].

Critical Impact
Attackers holding an affected VeraCrypt volume header can perform offline brute-force password guessing at drastically reduced computational cost, undermining volume confidentiality.

Affected Products

VeraCrypt non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND prior to 1.26.29
Volumes created by affected WOLFCRYPT=1 builds (require backup and recreation after patching)
Official precompiled VeraCrypt binaries and standard distribution packages are NOT affected

Discovery Timeline

2026-08-21 - CVE-2026-53762 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-53762

Vulnerability Analysis

VeraCrypt derives volume-header keys from user passwords using PBKDF2-HMAC with a large, tunable iteration count. The iteration count, optionally modified by the PIM, is the primary defense against offline password guessing. In builds using the wolfCrypt backend, the SHA-256 and SHA-512 code paths incorrectly invoke wc_HKDF instead of wc_PBKDF2. HKDF is a key-derivation function designed for expanding cryptographically strong inputs, not for stretching low-entropy passwords. It executes in near-constant time regardless of the iteration parameter, which the affected functions discard entirely.

An attacker who obtains an encrypted container, raw disk image, or extracted volume header can perform password guessing offline. Because the derivation cost no longer scales with iteration count or PIM, standard rate-limiting assumptions embedded in the VeraCrypt design no longer hold.

Root Cause

The root cause is an incorrect key-derivation primitive selection in src/Crypto/wolfCrypt.c. The wolfCrypt-backed implementations of derive_key_sha256 and derive_key_sha512 call wc_HKDF and ignore the caller-supplied iteration count, breaking the equivalence with the reference PBKDF2-HMAC backend.

Attack Vector

Exploitation requires local access to an affected encrypted volume, disk image, or captured volume header. The attacker performs offline password enumeration on their own hardware. No interaction with the target host is required after the artifact is acquired.

// Patch excerpt from src/Crypto/wolfCrypt.c
 #include "Aes.h"
 #include "Sha2.h"
 #include "../Common/Crypto.h"
-#include <wolfssl/wolfcrypt/hmac.h>
+#include "../Common/Pkcs5.h"
+#include <wolfssl/wolfcrypt/pwdbased.h>


 AES_RETURN aes_init()
// Source: https://github.com/veracrypt/VeraCrypt/commit/39f93910075e1cf492fcf4a9f99a53c7d0b96b87
// The fix replaces the HMAC-only include with pwdbased.h (PBKDF2) and
// routes SHA-256/SHA-512 derivations through the correct PBKDF2 implementation.

Detection Methods for CVE-2026-53762

Indicators of Compromise

Presence of VeraCrypt binaries built from source with WOLFCRYPT=1 and WOLFCRYPT_BACKEND set, prior to version 1.26.29.
VeraCrypt volumes that were created or re-keyed by an affected wolfCrypt build; these remain vulnerable even after upgrading the binary.
Unauthorized copies of .hc container files, raw disk images, or volume-header dumps leaving the environment via removable media, cloud sync, or email.

Detection Strategies

Inventory VeraCrypt installations and verify binaries originate from official releases or standard distribution packages rather than custom builds.
Inspect build systems and CI pipelines for the WOLFCRYPT=1 flag in VeraCrypt build scripts.
Audit file access telemetry for reads of VeraCrypt volume files by non-standard processes or accounts.

Monitoring Recommendations

Monitor endpoint logs for creation, copy, or exfiltration of .hc files and other VeraCrypt container artifacts.
Alert on outbound transfers of large binary blobs from hosts known to store encrypted volumes.
Track software installation events for VeraCrypt versions below 1.26.29 across managed endpoints.

How to Mitigate CVE-2026-53762

Immediate Actions Required

Upgrade all VeraCrypt installations to version 1.26.29 or later. See the VeraCrypt 1.26.29 release.
Identify volumes created by an affected WOLFCRYPT=1 build; back up the plaintext data, then recreate the volume using a corrected build because fixed builds derive different keys.
Treat any exfiltrated container or header from an affected build as compromised and rotate stored secrets accordingly.

Patch Information

The fix is delivered in VeraCrypt 1.26.29 via commit 39f93910075e1cf492fcf4a9f99a53c7d0b96b87, which routes SHA-256 and SHA-512 key derivation through PBKDF2 by including ../Common/Pkcs5.h and wolfssl/wolfcrypt/pwdbased.h. See the GitHub Security Advisory GHSA-94c6-mgmv-mqc5 and the upstream patch commit.

Workarounds

Use official precompiled VeraCrypt binaries or standard distribution packages, which use the PBKDF2 backend and are not affected.
If building from source, do not set WOLFCRYPT=1 or WOLFCRYPT_BACKEND until upgrading to 1.26.29 or later.
Restrict physical and logical access to encrypted volume files to prevent offline capture of headers by unauthorized parties.

bash

# Verify installed VeraCrypt version and rebuild without wolfCrypt if necessary
veracrypt --version

# Recommended source build (omit WOLFCRYPT flags to use PBKDF2 backend)
git clone https://github.com/veracrypt/VeraCrypt.git
cd VeraCrypt
git checkout VeraCrypt_1.26.29
cd src
make NOGUI=1 WOLFCRYPT=0