VeraCrypt 1.26.30 Fixes Windows Encryption Risk: Update Before Feature Upgrades

The project's home page sums the release up this way: it has been released with security fixes and platform-specific changes, according to OpenNET via Mallory. More useful to Windows administrators is what the changelog says about pre-boot encryption, Secure Boot and Windows Setup.

What changed for Windows users​

Two security fixes​

The first fix covers the files VeraCrypt uses to keep an encrypted system drive working through Windows upgrades. According to the official release notes, insufficient protection of system encryption support files could enable local privilege escalation during a qualifying Windows feature update or tampering with the BIOS loader during restoration. To fix it, VeraCrypt now protects setup scripts, driver packages and recovery backups, and rejects untrusted legacy backups and driver sources. This one is tracked as GHSA-w98h-pqh6-wfjj, and the GitHub release notes credit Kaarssteun with reporting it.

The second fix is smaller. It is listed as preventing local disclosure of limited disk metadata, tracked as CVE-2026-77572. The release notes credit artemy-ccrsky with the report.

Both are described as local problems. Nothing in the official text suggests a remote attack. That still matters: local privilege escalation is how an attacker who gets in as a low-privilege user ends up owning the machine. The official notes give no severity score for either Windows issue, so treat these as "patch soon," not "pull the network cable."

Upgrade order matters for encrypted system drives​

If VeraCrypt encrypts your Windows system drive, this note is the part to act on. The order of operations matters:

• Update VeraCrypt first. The project says to install the updated VeraCrypt before preparing a Windows feature update, and resolve any Windows update support or original loader backup warning.
• Check whether Windows Setup has already staged files. If Windows Setup has already staged support files, restart feature-update preparation so it stages the updated files; installing VeraCrypt does not replace a previously staged script.
• Keep your safety net. Preserve existing recovery backups and a known trustworthy VeraCrypt Rescue Disk.
• Don't trust old backups because you fixed their permissions. Changing an old backup's ownership or permissions does not establish that its contents are safe.

Step 2 is the easiest to miss. Say a PC has already downloaded and partly prepared a Windows 11 feature update. Installing VeraCrypt 1.26.30 at that point does not replace the support script Windows has already staged, so the old one would still be used. The project's instruction is to restart feature-update preparation so Setup stages the updated files.

Summary: If you use system encryption, update VeraCrypt before any feature update. If Setup has already staged files, restart its preparation. Keep your Rescue Disk and recovery backups.

Secure Boot and certificate changes​

The release continues work started in the previous version. In its notes on 1.26.29, Mallory reported that it brought EFI changes tied to Microsoft UEFI CA 2023, plus compatibility updates for Windows 11 25H2. Version 1.26.30 adds protections around that transition:

• It blocks installation of an incompatible EFI bootloader when Secure Boot is enabled.
• It refreshes VeraCrypt's copy of Windows Boot Manager from compatible Windows files.
• It warns when installed boot components need CA migration.
• It prompts you to recreate the Rescue Disk after bootloader certificate changes.
• It handles setup and upgrade failures better. The notes say it will retain recovery backups during uninstall, warn when an encrypted system's original loader backup is unavailable, and keep Windows Setup configuration failures independent of boot-loader repair.

The documentation has also been expanded to cover EFI Secure Boot certificate migration, KDF selection, supported operating systems and Windows builds. If you get the Rescue Disk prompt after a bootloader certificate change, don't dismiss it. An old Rescue Disk made for a different boot setup won't help much in an emergency.

Fixes for the 1.26.29 driver problems​

Anyone who had trouble with 1.26.29 should find relief here. The release notes say the update will fix driver stability regressions reported with VeraCrypt 1.26.29 and improve cleanup during mounting and dismounting. Restore the previous I/O completion behavior and disable ordered flush barriers by default. It also handles processor state-save failures safely during key derivation and fixes KDF worker completion and startup cleanup.

Smaller Windows fixes include:

• More accurate dismount status and drive-removal notifications, including for command-line dismounts.
• No more repeated errors when a favorite set to mount on device arrival finds its drive letter already taken.
• Saved PIM/KDF settings for favorite volumes now update after a password or header KDF change.
• The Argon2 and Argon2id command-line aliases now work, and n is accepted to turn off /protectScreen and /protectMemory.
• Windows and dialogs no longer open off screen or on the wrong monitor.
• Favorite labels with XML characters are handled correctly. Unicode paths are preserved, and extra carriage returns no longer pile up when configuration files are rewritten.
• The bundled zlib is now 1.3.2 and the LZMA SDK is 26.02.

Back up favorites before downgrading​

If you might go back to an older version, back up your ordinary and system favorite-volume configuration files first. Per the project, older versions can display XML escapes in labels and keep that text when saving, even after you upgrade again. Restore your backups or correct the labels after returning to this version. Once an older version saves the mangled labels, upgrading again won't fix them. Your backup will.

Fixes for every platform​

Some changes apply on every operating system:

• Security tokens and smart cards: token data is erased more thoroughly, and smart-card responses are limited to prevent hangs or excessive memory use. Freedom.tech's summary says to upgrade if using hardware tokens with VeraCrypt.
• PIM behavior: the release fixes unintended reuse of the current PIM when switching KDFs in the password-change and header-KDF dialogs. The selected KDF's default PIM is now used unless a new PIM is explicitly specified. If you change your KDF and expected to keep a custom PIM, enter it explicitly.
• Cryptographic correctness: fixes for big-endian processors, alignment crashes including on 32-bit ARM, and ChaCha output when processing successive partial blocks.
• Shutdown: better error handling in encryption workers, and VeraCrypt now waits for active work to finish before shutting down.

Linux, macOS and BSD​

On Unix-like systems, the main fix covers a heap buffer overflow, out-of-bounds reads and excessive memory allocations in the privileged service (CVE-2026-77372). In the project's GitHub advisory, this is rated Moderate. It affects versions up to 1.26.29 and is patched in 1.26.30. The advisory frames it as a local trust-boundary issue, not a remote one, and says Windows uses a different code path. The release also stops privileged-service file descriptors from leaking into child processes.

Linux and FreeBSD users who installed with the generic installer have a separate fix. It closes a hole that could let a separate local user replace the embedded package and gain root privileges. Distribution packages and AppImage builds aren't affected. ProHoster's write-up ties this to improper handling of temporary files in the /tmp directory by the installer.

On macOS, the fix covers FUSE-T cleanup that could leave decrypted volumes accessible after dismount (CVE-2026-108982). If you're upgrading from 1.26.29 with FUSE-T, dismount your volumes and restart macOS before using the new build. Replacing the app does not stop services that are already running. The release also fixes crashes with macFUSE 5.3.3 and later, and adds a preference to turn off screen protection, which stays on by default.

Other changes:

• Linux: read-only protection is enforced across loop devices, device-mapper layers and filesystems. FUSE sync requests are now passed to the backing file or device; before, a successful sync could leave data in the host cache. Volume files on GVfs shares and NFS shares with root_squash can now be writable. mount.veracrypt has been rewritten in POSIX shell.
• Command line: missing, oversized or badly encoded --stdin passwords are now rejected instead of silently becoming empty or truncated. Replacing an existing container now asks for confirmation unless you pass --force. doas is supported where sudo isn't available.
• FreeBSD detects ARM64 AES and SHA-256 hardware acceleration. OpenBSD can now create FFS volumes.

Who should update, and how quickly​

Windows installers, source archives, SHA256/SHA512 checksums and signatures are available from the official release channels. Check the signatures before installing; you're trusting this tool with your disk.

In short, 1.26.30 is not one dramatic fix. It's a wide cleanup with one Windows-specific trap. If you install it after Windows Setup has staged a feature update, the old support script is still the one that runs. Update VeraCrypt first, then upgrade Windows.