CVE-2026-108982 in VeraCrypt
Summary
by MITRE • 10/12/2026
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
VeraCrypt version 1.26.29, specifically when utilizing the FUSE-T backend on macOS, exhibits a critical resource management flaw that results in the persistence of decrypted data access after a volume has been formally dismounted by the user interface. This vulnerability stems from an improper cleanup procedure within the application's process lifecycle management logic. When a user initiates the unmounting or dismounting of a VeraCrypt container, the primary application correctly updates its internal state to reflect that the volume is no longer mounted in the traditional sense. However, it fails to signal and terminate the auxiliary background services responsible for handling file system operations via FUSE-T. These auxiliary processes include go-nfsv4 and associated core-service helpers which maintain active connections to the underlying storage infrastructure. Consequently, while the user interface indicates that access has been revoked, the technical mechanisms providing actual data retrieval remain operational in the background.
The technical root cause lies in the failure of the main VeraCrypt process to send termination signals to these child processes upon volume dismounting. As a result, the go-nfsv4 service continues to run and maintains an open file handle or device reference to the raw encrypted container image on disk. This persistent state allows the auxiliary mount point to continue serving the decrypted contents of the volume over a loopback SMB session. The operating system does not automatically reclaim these resources because they are still actively held by running processes, even though those processes no longer have legitimate authorization from the user's perspective. This creates a discrepancy between the logical security boundary enforced by VeraCrypt and the actual physical access capabilities available through the file system interface provided by FUSE-T.
The operational impact of this vulnerability is significant for local users on macOS systems where this specific build configuration is employed. An attacker with local access to the machine, or any process running under a user account that previously accessed the volume, can exploit this stale mount point to retrieve sensitive data without possessing the decryption passphrase. The attack vector does not require complex exploitation techniques; it relies primarily on persistence and opportunistic access. For instance, an adversary could utilize macOS features such as the Open Recent menu or simply navigate to the path where the decrypted image was previously accessible to remount or read from the lingering SMB share. Additionally, since the underlying raw device handle remains open, a local user with sufficient privileges might attach volume.dmg directly from this stale auxiliary mount, effectively bypassing VeraCrypt's encryption protections entirely. This scenario poses severe risks for environments handling confidential corporate data, personal identifiable information, or other sensitive assets protected by disk encryption.
This vulnerability aligns closely with CWE-756: Missing Explicit Release of Resource after Effective Lifetime, as the application fails to release critical resources (processes and file handles) when they are no longer needed. It also relates to CWE-284: Improper Access Control, because the system continues to grant access privileges that should have been revoked upon dismounting. From a threat modeling perspective using MITRE ATT&CK, this behavior facilitates Local Privilege Escalation and Data Exfiltration via T1056 (Input Capture) or more accurately Lateral Movement techniques if shared resources are involved, but primarily it represents a failure in data sanitization and access control enforcement post-session. The fact that the macFUSE build is not affected highlights that this issue is specific to the implementation details of the FUSE-T backend integration rather than VeraCrypt's core encryption logic itself.
Mitigation strategies must focus on ensuring strict lifecycle management of auxiliary processes. Users should immediately upgrade to a patched version of VeraCrypt where the dismount routine explicitly terminates all associated helper services and closes device handles before reporting success to the user interface. In the interim, administrators can mitigate risk by manually verifying that no go-nfsv4 or related VeraCrypt helper processes remain active after unmounting volumes through system monitoring tools like Activity Monitor or command-line process inspection utilities such as ps or lsof. If any residual processes are detected, they should be terminated manually to close the open handles and revoke access until a permanent software fix is deployed. Furthermore, organizations relying on this specific build configuration for high-security environments should consider switching to alternative disk encryption solutions that demonstrate more robust resource cleanup practices across all supported backends.