Heap Overflow Vulnerability in VeraCrypt Disk Encryption Software

CVE-2026-77372

What is CVE-2026-77372?

VeraCrypt, a disk encryption software based on TrueCrypt, is vulnerable due to improper handling of untrusted length and count values during the deserialization of data. This flaw, present in the serialization paths for Unix, macOS, and FreeBSD, allows an allocated size to exceed the specified bounds, which could lead to heap corruption. Specifically, the Serializer::DeserializeWString function may allocate fewer elements than needed, enabling a potential overflow, while VolumePassword::Deserialize can process excessively large password sizes beyond its designated buffer of 128 bytes. These issues can facilitate memory exhaustion attacks or unauthorized access to data, although Windows environments exhibit protections against remote exploitation due to different architectural paths. This vulnerability was patched in version 1.26.30.

References