Software-update: VeraCrypt 1.26.30

Versie 1.26.30 van VeraCrypt is uitgekomen. VeraCrypt is ontstaan als een fork van TrueCrypt en is een open source encryptieprogramma waarmee een harde schijf, partitie of een virtueel volume kan worden versleuteld. VeraCrypt gebruikt de originele broncode van TrueCrypt, maar bevat diverse verbeteringen met betrekking tot de beveiliging. In deze uitgave zijn de volgende veranderingen en verbeteringen aangebracht:

All OSes:

• Security: Improve erasure of security token data and limit smart card responses to prevent hangs or excessive memory use.
• Fix unintended reuse of the current PIM when switching KDFs in the password-change and header-KDF dialogs. The selected KDF's default PIM is now used unless a new PIM is explicitly specified.
• Fix cryptographic errors on processors using big endian byte order. Prevent alignment crashes on affected processors, including 32 bit ARM (GH #1899, GH #1908, GH #1909).
• Fix ChaCha output when processing successive partial blocks.
• Improve encryption worker error handling and wait for active work to finish before shutdown.
• Update translations and correct missing entries, formatting placeholders and escaped punctuation.
• Expand documentation for EFI Secure Boot certificate migration, KDF selection, supported operating systems and Windows builds.

Windows:

Favorite labels when downgrading: Back up your ordinary and system favorite volume configuration files before downgrading. Older versions can display XML escapes in labels and keep that text when saving, even after you upgrade again. Restore your backups or correct the labels after returning to this version.

Upgrade note for system encryption: Install the updated VeraCrypt before preparing a Windows feature update, and resolve any Windows update support or original loader backup warning. If Windows Setup has already staged support files, restart feature-update preparation so it stages the updated files; installing VeraCrypt does not replace a previously staged script. Preserve existing recovery backups and a known trustworthy VeraCrypt Rescue Disk. Changing an old backup's ownership or permissions does not establish that its contents are safe.

• Security: Fix insufficient protection of system encryption support files that could enable local privilege escalation during a qualifying Windows feature update or tampering with the BIOS loader during restoration (GHSA-w98h-pqh6-wfjj). Protect setup scripts, driver packages and recovery backups, and reject untrusted legacy backups and driver sources.
• Security: Fix a local disclosure of limited disk metadata (CVE-2026-77572).
• Fix driver stability regressions reported with VeraCrypt 1.26.29 and improve cleanup during mounting and dismounting. Restore the previous I/O completion behavior and disable ordered flush barriers by default.
• Handle processor state-save failures safely during key derivation and fix KDF worker completion and startup cleanup.
• Improve system encryption setup and upgrade failure handling. Retain recovery backups during uninstall, warn when an encrypted system's original loader backup is unavailable, and keep Windows Setup configuration failures independent of boot-loader repair.
• Prevent incompatible EFI bootloader installation when Secure Boot is enabled. Refresh the Windows Boot Manager copy from compatible Windows files.
• Warn when installed boot components need CA migration and prompt users to recreate the Rescue Disk after bootloader certificate changes.
• Correct dismount status reporting and drive removal notifications, including command line dismounts (GH #1852).
• Prevent repeated errors when a favorite set to mount on device arrival has a drive letter already occupied by another device.
• Update stored favorite volume PIM/KDF metadata after password or header KDF changes.
• Fix Argon2 and Argon2id command line aliases, and accept n to disable /protectScreen and /protectMemory.
• Fix windows and dialogs appearing off screen or on the wrong monitor (GH #1858, GH #1865, GH #1912).
• Fix favorite labels containing XML characters and prevent label text from changing saved mount options (GH #1946).
• Preserve Unicode paths and literal XML entity text in saved settings. Prevent extra carriage returns from accumulating when configuration files are rewritten.
• Fix partially translated interfaces and untranslated menu items and benchmark controls (GH #1587, GH #1929, GH #1930).
• Update bundled zlib to 1.3.2 and LZMA SDK to 26.02.

Linux, macOS and BSD:

• Security: Fix a heap buffer overflow, out-of-bounds reads and excessive memory allocations when deserializing requests in the privileged service (CVE-2026-77372).
• Security: Prevent privileged-service communication and authentication file descriptors from leaking into child processes.
• Detect CPU features before starting core services so mounted volumes use available hardware acceleration. Correct failed instruction probes on older processors (GH #1939).
• Preserve forced read-only protection when mounting partially encrypted system volumes through FUSE.
• Make unattended unmount commands return a nonzero exit status when a busy volume can't be unmounted.
• Support doas when sudo isn't available, including opendoas on FreeBSD. Avoid repeated password prompts after successful authentication.
• Preserve hidden volume protection when mounting favorites, including during credential retries. Keep each favorite's mount options separate.
• Cache the credentials actually used to mount a volume and preserve cancellation and other non-credential errors during automatic backup-header retries.
• Reject missing, oversized or incorrectly encoded --stdin passwords instead of silently using an empty or truncated password. Decode the complete first line using the current locale (GH #1935).
• Require confirmation before replacing an existing container file during command line creation. Use --force to allow replacement without a prompt (GH #1861).
• Honor --no-size-check during command line container creation (GH #1756).
• Expose BLAKE2b-512 in random-pool, keyfile-generation and hash-benchmark dialogs, including when using Argon2id.
• Preserve paths containing XML special characters and literal XML entity text in favorites, volume history and settings (GH #1943).
• Fall back to English when a language file is unusable, and fix password-length warnings and busy-volume dismount confirmation messages (GH #1944).

Linux and FreeBSD:

• Security: Fix a generic installer vulnerability that could let a separate local user replace the embedded package and gain root privileges (GHSA-wf3r-pjv3-fcxx). Distribution packages and AppImage builds aren't affected.
• Improve volume-file and tray icons, and make desktop cache updates optional when the required utilities aren't installed.

Linux:

• Enforce read-only protection on loop devices, all device-mapper layers and filesystems. Automatically mount volumes as read only when the backing block device reports write protection, even if it permits an open request with write access.
• Forward sync requests for volumes mounted through FUSE to the backing file or device and report flush failures. Previously, a successful sync could leave data in the host cache.
• Check that devices belong to the selected volume before dismount or filesystem checks. Leave externally supplied host devices attached and refuse normal dismount while a decrypted loop device remains in use.
• Support writable volume files on shares that restrict root access, including GVfs and NFS with root_squash (GH #23). Keep the share mounted and the user session active until dismount.
• Improve mounting on minimal systems, including FAT and exFAT detection. Use FUSE automatically when dmsetup isn't installed (GH #1898).
• Support NixOS helper locations and report when launcher restrictions block administrator authentication (GH #1911).
• Rewrite mount.veracrypt in POSIX shell, honor read-only options and supported mount(8) flags, reject invalid options, and fix argument quoting (GH #1895, GH #1928).
• Fix installation on systems with a merged /usr layout (GH #1764).

macOS:

Upgrade note for FUSE-T users: When upgrading from VeraCrypt 1.26.29, dismount your volumes and restart macOS before using the updated build. Replacing the application doesn't end services that are already running.

• Security: Fix FUSE-T cleanup that could leave decrypted volumes accessible after dismount (CVE-2026-108982). Protect auxiliary mounts and report when service shutdown can't be confirmed.
• Security: Validate disk device ownership changes and prefer trusted system utilities when running privileged operations (GH #1758, GH #1790).
• Fix mounting and dismounting crashes with macFUSE 5.3.3 and later (GH #1887).
• Fix Check Filesystem and Repair Filesystem so they operate on the selected volume and show their results in Terminal (GH #1791).
• Add a preference to disable screen protection, which remains enabled by default.
• Improve disk-image discovery and avoid detaching unrelated disks when device numbers are reused after an external eject. Keep volume status updates responsive.

FreeBSD:

• Detect ARM64 AES and SHA-256 hardware acceleration while retaining software fallbacks.

OpenBSD:

• Add FFS volume creation in the wizard and on the command line.

Building and packaging:

• Fix builds with NOASM or NOSSE2, and Argon2 builds targeting x86-64-v3/v4 or XOP (GH #1891, GH #1896, GH #1906).
• Fix FreeBSD ARM builds and local Apple Silicon builds (GH #1678, GH #1934). Restore Linux builds with GCC 4.4 and fix INDICATOR=1 tray-menu builds (GH #1823).
• Let wxWidgets builds follow the parent make's parallel job settings, including OpenWrt builds (GH #1903).
• Remove OpenWrt's Bash dependency and preserve SDK package selections (GH #1932).
• Improve macOS signing and notarization validation, and refresh app bundles before packaging.
• Remove the MFC dependency from Windows driver resource compilation.

Versienummer	1.26.30
Releasestatus	Final
Besturingssystemen	macOS, Windows 10, Windows 11
Website	VeraCrypt
Download	https://veracrypt.io/en/Downloads.html
Licentietype	GPL

Reacties (4)

[litebyte]

Heeft iemand ervaringen met andere open source software dat een vergelijkbare werking en beveiliging bieden?

[jb044]

Niet echt, wel ZFS encryption en ook LUKS onder Linux, maar dat is allemaal redelijk dicht op operating systems specifieke tooling. Qua iets dat je puur gebruikt voor enccryptie en dat ook redelijk betrouwbaar is en opensource, is dit wel redelijk voor de hand liggend. Wat is je probleem met VeraCrypt?

[Reactie gewijzigd door jb044 op 25 oktober 2026 17:41]

[litebyte]

Ik heb geen enkel probleem met Veracrypt, gebruikte ook al daarvoor de zegmaar voorganger. Vroeg me alleen af of er nog alternatieven zijn, want ik ken verder geen enkele open source die werken zoals Veracrypt.

[Bor]

De interessantste fixes zitten eigenlijk niet in de cryptografie zelf maar in de randvoorwaarden eromheen. Encryptie is vaak niet het zwakke punt. Installers, updateprocessen, bootloaders, recoverybestanden en privilege-afhandeling zijn dat veel vaker.

Voor Windows springt vooral de local privilege escalation rond feature updates eruit. Voor Linux/macOS/BSD zijn de fixes in de privileged service relevanter dan de gemiddelde gebruiker misschien denkt. Dat zijn precies de componenten die met verhoogde rechten draaien en dus interessant zijn voor aanvallers.