Notify on direct favorite mount success using the returned protection mode.
Keep recovered mounts on their existing notification path, and use the
returned mode there as well so read-only overrides are reflected accurately.
Handle protection failures before outer-password retries, retain cached and
explicit outer credentials without adding default keyfiles, and focus the
hidden-protection controls. Initialize hidden PIM and KDF independently,
and retain an accepted backup header during protection recovery.
Retry embedded backup headers after repeated hidden-protection failures
without advancing the outer-password retry count. Restore the accepted
primary-header selection if backup authentication fails, and report
automatic backup use only when the selected header remains a backup.
Keep primary-header recovery available after an automatic backup attempt
fails with EIO, while reporting the error. Preserve cancellation and
other error handling.
Pass known protection failures from favorite mounts directly into GUI
recovery, including keyfile-only credentials with a null password. Skip
redundant authentication attempts and preserve the text interface's
existing retry path.
Initialize the backup-header checkbox with the other validated controls,
so an initial backup-header request survives the first password prompt.
Conceal the accepted outer password and PIM before disabling their
controls during protection recovery.
Reuse hidden-credential recovery for cached and backup-header attempts.
Keep the outer credential source and backup selection during correction.
Warn about automatic backup-header use only after mounting succeeds.
Handle protection-keyfile failures before general password failures.
Reset the hidden password, PIM, and keyfiles for correction while retaining
outer credentials and avoiding backup-header retries.
Check MissingArgument, NoItemSelected, and StringFormatterException before
UserInterfaceException in both rethrow helpers. This prevents slicing
and preserves their specific exception types and diagnostics.
Check PasswordIncorrect subclasses before the base class in both UI
exception handlers. This prevents slicing and preserves the specific
protection and keyfile error messages.
Reuse the prepared password to avoid rereading outer keyfiles after
mounting. This prevents post-mount read failures and ensures the cache
contains the credential that unlocked the volume.
Apply protection keyfiles once in the application, including cached-password
mounts. This keeps PC/SC out of the core service before FUSE forks.
Preserve protection errors and cache retries, and ignore protection
credentials when protection is disabled.
Persist a macOS-only preference for disabling wx content protection while keeping protection enabled by default.
Add a Preferences checkbox that reuses IDC_DISABLE_SCREEN_PROTECTION and reapply the protection state after preference changes.
Apply content-protection updates to all current top-level wx windows so changing the preference while a modal dialog is active does not leave the main frame or other windows with stale protection state.
Separate sudo authentication success from elevated request execution state by acknowledging when the elevated core service starts successfully.
Once that channel is available, propagate later failures instead of showing repeated administrator password dialogs. Initialize the sudo dummy-password flag consistently on macOS, avoiding an uninitialized read of UseDummySudoPassword.
Register admin-password cleanup before elevation attempts so plaintext sudo credentials are erased on early-return and post-sudo failure paths.
References #1788.
Install a macOS-specific secure text field hotkey handler so Command-A selects the full contents of password controls when Cocoa does not route the shortcut through wxWidgets accelerators. Keep the existing wxWidgets accelerator handler for Command-V and Command-A, and recognize the standard paste/select-all IDs when they do reach the C++ event path.
Add Objective-C++ compilation support for the macOS helper and include it in the GUI target only on macOS.
Fixes https://github.com/veracrypt/VeraCrypt/issues/1567
Pass -R to newfs_exfat in both GUI and text-mode volume creation so macOS derives a fresh exFAT layout instead of preserving stale geometry from an existing exFAT boot region. This matches Finder/Disk Utility erase behavior.
Validated on Windows 11: chkdsk no longer reports boot-region corruption on volumes formatted this way.
Fixes#1021.
The volume size page populates the unit wxChoice after the generated base class has already fit the empty control. On macOS this can leave the closed choice too narrow, truncating MiB to .... Measure the localized unit labels after appending them and set a sufficient minimum width.
On Unix and macOS, the hidden volume wizard estimates the available space for non-FAT outer filesystems using statvfs(). The previous calculation used f_bsize with f_bavail, which can overstate available bytes on macOS exFAT because f_bsize may be the preferred I/O size instead of the fragment size associated with the block counts.
Use f_frsize when it is reported, fall back to f_bsize, and clamp the non-FAT estimate to the actual outer VeraCrypt data size before applying the existing 80% safety heuristic.
Also harden hidden volume creation in both the cross-platform VolumeCreator path and the Windows/common formatting path by rejecting sizes that would exceed the hidden host data area and overlap volume header space.
Fixes#1037
Prefer hdiutil plist entities that carry a mount-point when recording the virtual device. This fixes APFS images where the first dev-entry is not the mounted volume.
Add a macOS mounted-volume refresh hook that recovers VirtualDevice and MountPoint from hdiutil info when FUSE-T SMB auxiliary metadata is missing or stale.
Add a -t option to build_veracrypt_macosx.sh so VC_OSX_TARGET can be set explicitly while preserving the existing defaults for source and Homebrew builds.
Fixes#1726.
Keep device selection enumeration unchanged to avoid slow dialog loads.
In the format wizard, inspect only the selected target with diskutil info -plist and reject APFS synthesized devices, macOS system/support targets, read-only targets, and current APFS system stores. Add a read-only APFS hint for creation failures.
Make /aux-device-info readable for SMB, verify that FUSE records hdiutil device info after mount and recover missing virtual devices from hdiutil before dismounting auxiliary mounts.
When VeraCrypt is run as an AppImage, the veracrypt binary resides in a SquashFS mount under /tmp which is inaccessible to root. Using this path with sudo results in a "command not found" error.
This patch detects the AppImage environment by checking both APPIMAGE and APPDIR variables, ensuring the executable path starts with APPDIR and that APPDIR starts with the expected "/tmp/.mount_Veracr" prefix. In this scenario, the AppImage file itself (APPIMAGE) is used as the executable for sudo, resolving the elevation issue.
- Added parameters for cluster size (auto/manual), encryption/hash, safety margin, VeraCrypt overhead, and VeraCrypt path override
- Switched to iterative exFAT size calculation for accurate FAT/bitmap sizing
- Auto-selects optimal cluster size based on data size
- Supports -WhatIf/-Confirm (SupportsShouldProcess) for safe operation
- Allows password via pipeline or prompt; improved error handling and cleanup
- Enhanced output, free space checks, and force-overwrite option
- Improved code structure, comments, and user feedback
This commit updates several strings in the Italian language file
based on an expert review.
The changes focus on:
- Using more idiomatic phrasing (e.g., "negazione plausibile").
- Employing standard IT terminology (e.g., "Codice di errore").
- Adjusting formality for better UX (e.g., informal commands, recommendations).
- Improving sentence structure for system messages (e.g., impersonal "si").
The method GetNodes implementation didn't parse multiple attributes correctly and it failed with Hungarian XML because of the presence of '>' character in an attribute value.
Issue reported in https://github.com/veracrypt/VeraCrypt/pull/1516
Now we properly honor the AllowDefrag configuration.
This regression introduced other issues because, in order to allow defragmentation, we must provide Windows with an actual physical disk number. As a result, we assign the number of the physical disk where the VeraCrypt volume resides. This, in turn, causes Windows to send IOCTLs directly to this disk instead of to VeraCrypt. If these IOCTLs return values and properties not supported by VeraCrypt, inconsistencies arise, leading to failures.
Added security checks to prevent mounting VeraCrypt volumes on system directories (like /usr/bin) or directories in the user's PATH, which could theoretically allow execution of malicious binaries instead of legitimate system binaries.
Key changes:
- Block mounting on protected system directories (/usr, /bin, /lib, etc.)
This restriction cannot be overridden
- Block mounting on directories present in user's PATH environment variable
This can be overridden with --allow-insecure-mount flag
- Add visual warnings (red border, "[INSECURE MODE]") when mounting on PATH directories is allowed
- Handle symlinks properly when checking paths
- Add new error messages for blocked mount points
To override PATH-based restrictions only (system directories remain protected):
veracrypt --allow-insecure-mount [options] volume mountpoint
Security Impact: Low to Medium
The attack requires either:
- User explicitly choosing a system directory as mount point instead of using VeraCrypt's default mount points
- Or attacker having both filesystem access to modify favorites configuration AND knowledge of the volume password
Default mount points are not affected by this vulnerability.
Security: CVE-2025-23021
This commit fixes a critical security vulnerability where VeraCrypt could be tricked into executing malicious binaries with elevated privileges. The vulnerability has two severe implications:
1. When sudo's secure_path option is disabled, attackers could execute malicious binaries with root privileges by placing them in user-writable PATH directories (e.g., making "sudo mount" execute a malicious mount binary)
2. By placing a malicious sudo binary in PATH, attackers could intercept and steal the user's password when VeraCrypt prompts for sudo authentication
The vulnerability allowed attackers to place malicious binaries in user-writable directories that appear in PATH before system directories, potentially leading to privilege escalation and credential theft.
Key changes:
- Implement FindSystemBinary() to locate executables in secure system paths
- Replace all relative binary paths with absolute paths for system commands
- Add security checks for executable permissions
- Update process execution to use absolute paths for:
* sudo
* mount
* fsck
* terminal emulators
* file managers
* system utilities (hdiutil, mdconfig, vnconfig, lofiadm)
The fix ensures all system binaries are called using their absolute paths from secure system directories, preventing both privilege escalation through PATH manipulation and password theft through sudo hijacking.
Security: CVE-2024-54187
Issue was caused by the fact that Microsoft signing certificate for driver file has changed.
We fix it by updating the SHA512 fingerprint of Microsoft code signing certificate.
In a Debian-style APT repository, the pool/ directory groups packages primarily by source package name and binary package name, version, architecture, etc. If two distinct .deb files have identical name and version (as seen in their control file) and same architecture, reprepro will report a conflict when adding one after the other.
So, we need to append distro-specific string to the existing version in order to avoid such conflict when creating VeraCrypt APT repository.
This commit increases randomness quality by using more dynamic/varied sources of entropy.
PDH-based disk and network statistics collection in now added to random pool
- Introduced `GetDiskStatistics` to gather disk read/write performance data using PDH API.
- Introduced `GetNetworkStatistics` to gather network send/receive performance data using PDH API.
- Integrated high-resolution timestamps and random intervals to improve entropy in collected data.
- Updated `SlowPoll` function to utilize PDH-based disk and network statistics.
- Removed obsolete NetAPI32-based network statistics collection.
- Add IsWin10BuildAtLeast() helper function to check Windows 10 build numbers
- Replace direct build number comparison with IsWin10BuildAtLeast() for ReflectDrivers check
- Update error message to be more specific about Windows version requirement
This update simplifies the logic for detecting active sudo sessions by checking the exit code of the sudo -n -l command, which reliably returns 0 if a session is active.
Additionally, this approach is now applicable to recent macOS versions, as they no longer have the sudo bug that previously prevented us from using this method.
Mounir IDRASSI