Weak Cryptographic Implementation in VeraCrypt Disk Encryption

CVE-2026-53762

What is CVE-2026-53762?

VeraCrypt, a popular tool for disk encryption based on TrueCrypt, presents a significant vulnerability in versions prior to 1.26.29. This issue arises from non-default builds configured with WOLFCRYPT=1, where the key derivation process for SHA-256 and SHA-512 does not properly implement the configured iterations value. Instead, it utilizes wc_HKDF, leading to weaker security against password guessing attacks. Specifically, the inability to increase derivation costs allows attackers to perform offline dictionary or brute force attacks at a considerably lower expense. It is crucial for users to migrate to the patched version (1.26.29) as affected builds require replacement and restoration of encrypted volumes to ensure data security.

References