{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.26.29"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "d26216c294fdfb090ee856f6195c294176defa1d"
            }
          ],
          "repo": "https://github.com/veracrypt/veracrypt",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-9mgv-w2fw-3m78"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77572.json"
  },
  "details": "VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local user who can open the intentionally user-accessible \\.\\VeraCrypt device can use TC_IOCTL_GET_RESOLVED_SYMLINK, TC_IOCTL_GET_DRIVE_PARTITION_INFO, VC_IOCTL_GET_DRIVE_GEOMETRY_EX, or the legacy TC_IOCTL_GET_DRIVE_GEOMETRY handler to make src/Driver/Ntdriver.c perform kernel-context symbolic-link or disk-device lookups outside the intended path scope. This can disclose low-sensitivity drive-letter targets, partition information, disk geometry, GPT or MBR state, and limited object-manager path metadata.",
  "id": "CVE-2026-77572",
  "modified": "2026-10-15T02:30:57.695025890Z",
  "published": "2026-10-14T15:26:31.329Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77572.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/veracrypt/VeraCrypt/commit/ca35405421df549e75f1f241259bdda0c5b67d40"
    },
    {
      "type": "WEB",
      "url": "https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-9mgv-w2fw-3m78"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77572"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\\\.\\VeraCrypt"
}