CVE-2026-54073: VeraCrypt: Hidden volume quick format weakens plausible deniability
VeraCrypt provides disk encryption with strong security based on TrueCrypt. From 1.26.6 until 1.26.29, file-hosted hidden volume creation forces quick format and the FormatNoFs function in src/Common/Format.c and FormatFat function in src/Common/Fat.c use WriteFile to place raw zeroed sectors at predictable 128 MiB intervals. These writes bypass the normal EncryptDataUnits formatting path, leaving deterministic plaintext markers in an area expected to resemble random ciphertext. The markers can weaken plausible deniability during forensic inspection, although they do not disclose hidden-volume content or reduce the strength of VeraCrypt encryption. This issue is fixed in version 1.26.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VeraCryptto a version that resolves this vulnerability.Fixed in 1.26.29
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects file-hosted hidden volumes created with VeraCrypt versions 1.26.6 through 1.26.29. It concerns the plausible deniability property of those volumes rather than the confidentiality of their contents.
What would a forensic examiner need to detect it?
An examiner would need access to inspect the file-hosted hidden volume. Predictable raw zeroed-sector markers at 128 MiB intervals can distinguish areas that should appear as random ciphertext.
Does this expose hidden-volume data or break VeraCrypt encryption?
No. The issue does not disclose hidden-volume contents and does not reduce the strength of VeraCrypt encryption; it weakens plausible deniability.
How can the issue be remediated?
Upgrade to VeraCrypt 1.26.29, which fixes the formatting behavior.