CVE-2026-54073: VeraCrypt Hidden Volume Forensic Marker Flaw

CVE-2026-54073 Overview

CVE-2026-54073 affects VeraCrypt, an open-source disk encryption tool derived from TrueCrypt. Versions from 1.26.6 through 1.26.28 write deterministic plaintext markers during file-hosted hidden volume creation. The FormatNoFs function in src/Common/Format.c and the FormatFat function in src/Common/Fat.c place raw zeroed sectors at predictable 128 MiB intervals using WriteFile. These writes bypass the EncryptDataUnits path, leaving structured patterns in regions expected to contain random-looking ciphertext. The issue undermines plausible deniability during forensic analysis of outer volumes. This weakness does not disclose hidden-volume content or reduce cryptographic strength. The flaw is tracked under [CWE-693: Protection Mechanism Failure].

Critical Impact
Forensic examiners can identify the presence of a VeraCrypt hidden volume by detecting deterministic zeroed sectors at 128 MiB intervals, weakening the plausible deniability guarantee.

Affected Products

VeraCrypt 1.26.6 through 1.26.28 (file-hosted hidden volume creation)
src/Common/Format.c — FormatNoFs function
src/Common/Fat.c — FormatFat function

Discovery Timeline

2026-08-21 - CVE-2026-54073 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-54073

Vulnerability Analysis

VeraCrypt supports hidden volumes so that a user coerced into revealing a password can disclose an outer volume without exposing the existence of the inner one. This defense depends on the outer volume's free space being indistinguishable from random data. In affected versions, file-hosted hidden volume creation forces quick format and issues raw WriteFile calls that place zeroed sectors at fixed 128 MiB offsets. Because these writes skip EncryptDataUnits, the sectors on disk are plaintext zeros rather than pseudo-random ciphertext. A forensic investigator scanning the container for statistical anomalies can identify the periodic markers and infer that the volume was created with a specific VeraCrypt build path associated with hidden volumes. The confidentiality of the hidden volume contents remains protected, and the AES, Serpent, and Twofish primitives used by VeraCrypt are unaffected.

Root Cause

The quick-format path for file-hosted hidden volumes writes zero-filled sectors directly through WriteFile instead of routing them through the sector encryption function. The format code lacked awareness of the hiddenVol flag, so it treated hidden volume creation identically to standard volume formatting. This is a protection mechanism failure rather than a cryptographic defect.

Attack Vector

Exploitation requires local access to the encrypted container file. An analyst performing offline forensic inspection reads the container and searches for the deterministic zero patterns at 128 MiB boundaries. No credentials, network access, or code execution are required. The impact is limited to disclosure of the fact that a hidden volume workflow was used.

// Patch: src/Common/Format.c — propagate hiddenVol flag into format routine
CRYPTOPP_ALIGN_DATA(16) char originalK2[MASTER_KEYDATA_SIZE];
BOOL quickFormat = volParams->quickFormat;
BOOL bDevice = volParams->bDevice;
+BOOL hiddenVol = volParams->hiddenVol;

LARGE_INTEGER startOffset;
LARGE_INTEGER newOffset;
// Source: https://github.com/veracrypt/VeraCrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53

// Patch: src/Common/Fat.c — hidden volume awareness added to FAT format path
volatile FORMAT_VOL_PARAMETERS* volParams = (volatile FORMAT_VOL_PARAMETERS*)volParamsArg;
BOOL quickFormat = volParams->quickFormat;
BOOL bDevice = volParams->bDevice;
+BOOL hiddenVol = volParams->hiddenVol;

LARGE_INTEGER startOffset;
LARGE_INTEGER newOffset;
// Source: https://github.com/veracrypt/VeraCrypt/commit/689a59cd584f090ca5f9214d5f2f3a9eac499e53

Detection Methods for CVE-2026-54073

Indicators of Compromise

Deterministic zero-filled 512-byte sectors at 128 MiB offsets within a VeraCrypt file-hosted container.
VeraCrypt client versions 1.26.6 through 1.26.28 present on endpoints handling sensitive containers.
Container files created via the hidden-volume quick-format workflow on affected builds.

Detection Strategies

Inventory installed VeraCrypt versions across managed endpoints and flag any release between 1.26.6 and 1.26.28.
Use entropy analysis tooling on suspected VeraCrypt containers to identify low-entropy sectors at fixed 128 MiB intervals.
Review software deployment logs for VeraCrypt installations that predate 1.26.29.

Monitoring Recommendations

Track VeraCrypt binary hashes and versions using endpoint software inventory telemetry.
Alert when unmanaged users install disk-encryption utilities on corporate assets that store regulated data.
Record creation timestamps and file sizes of .hc containers to support forensic triage if disclosure is suspected.

How to Mitigate CVE-2026-54073

Immediate Actions Required

Upgrade VeraCrypt to version 1.26.29 on all systems that create or manage hidden volumes.
Recreate any hidden volumes originally provisioned with affected versions to eliminate the deterministic markers.
Restrict distribution of containers created with vulnerable builds if plausible deniability is required.

Patch Information

The issue is fixed in VeraCrypt 1.26.29. The upstream commit 689a59cd584f090ca5f9214d5f2f3a9eac499e53 propagates the hiddenVol flag into FormatNoFs and FormatFat, ensuring hidden-volume format writes are routed through the encryption path. Reference the VeraCrypt 1.26.29 release notes and GHSA-jjcr-75w7-58jp advisory for full details.

Workarounds

Avoid quick format for file-hosted hidden volumes on affected versions and choose full format where feasible.
Store containers created by vulnerable versions on media that will not be released to untrusted parties until the volumes are rebuilt on 1.26.29.
Where plausible deniability is not a requirement, continue using existing volumes since encryption strength is unaffected.

bash

# Verify installed VeraCrypt version on Linux
veracrypt --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\IDRIX\VeraCrypt" /v DisplayVersion

# Expected output after remediation: 1.26.29 or later