CVE-2026-53762: VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the configured iterations value is discarded and wcHKDF is used instead of PBKDF2-HMAC. Changing the PIM or iteration count therefore does not increase derivation cost, allowing an attacker with an affected container, disk image, or volume header to perform substantially cheaper offline password guesses. Official precompiled VeraCrypt binaries and normal distribution packages use the standard PBKDF2 backend and are not affected. Volumes created by an affected WOLFCRYPT=1 build require backup and recreation because corrected builds derive different keys. This issue is fixed in version 1.26.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VeraCryptto a version that resolves this vulnerability.Fixed in 1.26.29 - Operational
For volumes created by an affected non-default WOLFCRYPT=1 build (pre-1.26.29), back up the data and recreate the volumes using the corrected build, because corrected builds derive different keys.
Event History
Frequently Asked Questions
Which VeraCrypt deployments are affected?
Only non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND are affected. Official precompiled VeraCrypt binaries and normal distribution packages use the standard PBKDF2 backend and are not affected.
What does an attacker need to exploit this issue?
An attacker needs access to an affected container, disk image, or volume header in order to make offline password guesses. The defect makes those guesses substantially cheaper because configured PIM or iteration-count values do not increase key-derivation cost.
Does increasing the PIM or iteration count mitigate affected volumes?
No. In affected builds, the configured iteration value is discarded, so changing the PIM or iteration count does not increase the derivation cost.
What should be done for volumes created with an affected build?
Upgrade to VeraCrypt 1.26.29 or later, but do not rely on an in-place upgrade alone for existing affected volumes. Back up their contents and recreate the volumes, because corrected builds derive different keys.