{"schema":"threatline.record/2","record":{"id":"CVE-2026-108982","aliases":["GHSA-f3px-f8h2-fm4c"],"summary":"VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service ","details":"VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.)","categories":["Unclassified"],"product":"VeraCrypt","vendor":"IDRIX","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108982","source_modified_at":"2026-10-15T02:49:02.840Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"VeraCrypt","vendor":"IDRIX","versions":[{"status":"affected","version":"1.26.29","versionType":"semver"}],"defaultStatus":"unknown"},{"source":"GitHub Advisory Database","source_url":"https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-f3px-f8h2-fm4c","source_modified_at":"2026-10-14T04:48:35Z","fetched_at":"2026-10-24T14:26:37.433577Z","package":{"ecosystem":"","name":"VeraCrypt"},"range":"1.26.29"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00107,"percentile":0.01115,"score_date":"2026-10-23"},"published_at":"2026-10-12T02:44:04.730Z","modified_at":"2026-10-15T02:49:02.840Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108982","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T02:49:02.840Z"},{"source":"GitHub Advisory Database","url":"https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-f3px-f8h2-fm4c","fetched_at":"2026-10-24T14:26:37.433577Z","source_modified_at":"2026-10-14T04:48:35Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108982","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/issues/1779","tags":["exploit"]},{"source":"CVE List","url":"https://sourceforge.net/p/veracrypt/discussion/general/thread/57f938df8b/"},{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/issues/1845","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/pull/1866"},{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29","tags":["product"]},{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-f3px-f8h2-fm4c"},{"source":"CVE List","url":"https://github.com/veracrypt/VeraCrypt/commit/d7bc65bed004996d299ec76666d1b283a07e2526"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T18:25:54.498453Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T02:49:02.840Z","content_hash":"3c78369a8d6c7cfea5f792a2773c2625bbda74826527cdde15f6184d65e165a4"}}