Description

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPT_BACKEND route SHA-256 and SHA-512 volume-header key derivation through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c, where the configured iterations value is discarded and wc_HKDF is used instead of PBKDF2-HMAC. Changing the PIM or iteration count therefore does not increase derivation cost, allowing an attacker with an affected container, disk image, or volume header to perform substantially cheaper offline password guesses. Official precompiled VeraCrypt binaries and normal distribution packages use the standard PBKDF2 backend and are not affected. Volumes created by an affected WOLFCRYPT=1 build require backup and recreation because corrected builds derive different keys. This issue is fixed in version 1.26.29.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-21T19:17:02.570Z",
  "pubdate": "2026-08-21T19:17:02.570Z",
  "executiveSummary": "A cryptographic implementation vulnerability exists in VeraCrypt prior to version 1.26.29, specifically affecting non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND.\nThe flaw involves improper cryptographic key derivation, where the application incorrectly routes SHA-256 and SHA-512 volume-header key derivation through derive_key_sha256 and derive_key_sha512 in src/Crypto/wolfCrypt.c.\nConsequently, the configured iterations value is entirely discarded, and wc_HKDF is invoked instead of the mandated PBKDF2-HMAC mechanism.\nThis failure causes user-defined parameters such as the Personal Iteration Multiplier (PIM) or custom iteration counts to fail in increasing the computational derivation cost.\nAn attacker possessing an affected container, disk image, or volume header can exploit this vulnerability to execute substantially cheaper offline password-guessing attacks, drastically reducing the cryptographic work factor required to brute-force weak passphrases.\nOfficial precompiled VeraCrypt binaries and standard distribution packages utilize the standard PBKDF2 backend and remain unaffected by this issue.\nRemediation requires upgrading to version 1.26.29 or later, and because corrected builds derive fundamentally different keys, previously created volumes under affected builds necessitate backup and complete recreation.",
  "technicalDetails": "The root cause of the vulnerability resides in the cryptographic backend integration logic within non-default VeraCrypt builds compiled using the WOLFCRYPT=1 and WOLFCRYPT_BACKEND flags.\nSpecifically, the vulnerable components are the derivation functions derive_key_sha256 and derive_key_sha512 implemented within the source file src/Crypto/wolfCrypt.c.\nDuring the volume-header key derivation process, these specific functions fail to honor the iteration count parameter provided by the user or configuration settings.\nInstead of applying the security-critical PBKDF2-HMAC key stretching algorithm designed to artificially inflate the computational complexity of key generation, the implementation incorrectly invokes the wc_HKDF function.\nHKDF (HMAC-based Extract-and-Expand Key Derivation Function) operates with a fundamentally different performance and security profile compared to PBKDF2, executing with minimal computational overhead and lacking an iterative delay factor.\nThe attack flow proceeds as follows: an attacker acquires an affected VeraCrypt container, disk image, or isolated volume header.\nBecause the vulnerable WolfCrypt backend discards the configured iteration count and PIM values during the derivation phase, the cryptographic keys are derived with a minimal, constant computational cost rather than the expected high work factor.\nThe attacker then initiates an offline brute-force or dictionary attack against the volume header.\nDue to the absence of the intended iteration scaling, the computational resources required to test each candidate password are reduced by orders of magnitude.\nThis allows the attacker to rapidly evaluate a massive keyspace of potential passwords in a fraction of the time normally required, effectively bypassing the security controls intended by high PIM or iteration settings.\nAffected versions include any custom builds of VeraCrypt prior to 1.26.29 compiled with the specified WolfCrypt parameters.\nThe exploitation vector is entirely offline, requiring no network exposure, authentication, or local system privileges beyond possession of the target container or volume header data.\nPost-exploitation impact includes the successful recovery of the mount password, leading to full confidentiality compromise of the encrypted data contained within the volume."
}