1.26.30 Released 2026/10/24

[Enigma2Illusion]

Version 1.26 and newer VeraCrypt versions have deprecated the following features:

• TrueCrypt Mode
• HMAC-RIPEMD-160 Hash Algorithm
• GOST89 Encryption Algorithm

.
See the documentation below for remediation procedures.

Conversion Guide for VeraCrypt 1.26 and Later

---

Warning to users who created hidden volumes inside file containers using VeraCrypt 1.26.6 through 1.26.28:

A security issue fixed in VeraCrypt 1.26.29 and later versions may affect the plausible deniability of these hidden volumes. If you rely on plausible deniability, you should recreate the affected outer file container and its hidden volume using VeraCrypt 1.26.29 or later, then securely erase the old container.

---

https://sourceforge.net/projects/veracrypt/files/VeraCrypt%201.26.30/

Changes between 1.26.29 and 1.26.30 (24 October 2026):

• All OSes:

  • Security: Improve erasure of security token data and limit smart card responses to prevent hangs or excessive memory use.
  • Fix unintended reuse of the current PIM when switching KDFs in the password-change and header-KDF dialogs. The selected KDF's default PIM is now used unless a new PIM is explicitly specified.
  • Fix cryptographic errors on processors using big endian byte order. Prevent alignment crashes on affected processors, including 32 bit ARM (GH #1899, GH #1908, GH #1909).
  • Fix ChaCha output when processing successive partial blocks.
  • Improve encryption worker error handling and wait for active work to finish before shutdown.
  • Update translations and correct missing entries, formatting placeholders and escaped punctuation.
  • Expand documentation for EFI Secure Boot certificate migration, KDF selection, supported operating systems and Windows builds.
    .

• Windows:

  • Security: Fix insufficient protection of system encryption support files that could enable local privilege escalation during a qualifying Windows feature update or tampering with the BIOS loader during restoration (GHSA-w98h-pqh6-wfjj). Protect setup scripts, driver packages and recovery backups, and reject untrusted legacy backups and driver sources.
  • Security: Fix a local disclosure of limited disk metadata (CVE-2026-77572, GHSA-9mgv-w2fw-3m78).
  • Fix driver stability regressions reported with VeraCrypt 1.26.29 and improve cleanup during mounting and dismounting. Restore the previous I/O completion behavior and disable ordered flush barriers by default.
  • Handle processor state-save failures safely during key derivation and fix KDF worker completion and startup cleanup.
  • Improve system encryption setup and upgrade failure handling. Retain recovery backups during uninstall, warn when an encrypted system's original loader backup is unavailable, and keep Windows Setup configuration failures independent of boot-loader repair.
  • Prevent incompatible EFI bootloader installation when Secure Boot is enabled. Refresh the Windows Boot Manager copy from compatible Windows files.
  • Warn when installed boot components need CA migration and prompt users to recreate the Rescue Disk after bootloader certificate changes.
  • Correct dismount status reporting and drive removal notifications, including command line dismounts (GH #1852).
  • Prevent repeated errors when a favorite set to mount on device arrival has a drive letter already occupied by another device.
  • Update stored favorite volume PIM/KDF metadata after password or header KDF changes.
  • Fix Argon2 and Argon2id command line aliases, and accept n to disable /protectScreen and /protectMemory.
  • Fix windows and dialogs appearing off screen or on the wrong monitor (GH #1858, GH #1865, GH #1912).
  • Fix favorite labels containing XML characters and prevent label text from changing saved mount options (GH #1946).
  • Preserve Unicode paths and literal XML entity text in saved settings. Prevent extra carriage returns from accumulating when configuration files are rewritten.
  • Fix partially translated interfaces and untranslated menu items and benchmark controls (GH #1587, GH #1929, GH #1930).
  • Update bundled zlib to 1.3.2 and LZMA SDK to 26.02.
    .

Favorite labels when downgrading: Back up your ordinary and system favorite volume configuration files before downgrading. Older versions can display XML escapes in labels and keep that text when saving, even after you upgrade again. Restore your backups or correct the labels after returning to this version.

Upgrade note for system encryption: Install the updated VeraCrypt before preparing a Windows feature update, and resolve any Windows update support or original loader backup warning. If Windows Setup has already staged support files, restart feature-update preparation so it stages the updated files; installing VeraCrypt does not replace a previously staged script. Preserve existing recovery backups and a known trustworthy VeraCrypt Rescue Disk. Changing an old backup's ownership or permissions does not establish that its contents are safe.
.

• Linux, macOS and BSD:

  • Security: Fix a heap buffer overflow, out-of-bounds reads and excessive memory allocations when deserializing requests in the privileged service (CVE-2026-77372, GHSA-4j3p-7hp7-xw73).
  • Security: Prevent privileged-service communication and authentication file descriptors from leaking into child processes.
  • Detect CPU features before starting core services so mounted volumes use available hardware acceleration. Correct failed instruction probes on older processors (GH #1939).
  • Preserve forced read-only protection when mounting partially encrypted system volumes through FUSE.
  • Make unattended unmount commands return a nonzero exit status when a busy volume can't be unmounted.
  • Support doas when sudo isn't available, including opendoas on FreeBSD. Avoid repeated password prompts after successful authentication.
  • Preserve hidden volume protection when mounting favorites, including during credential retries. Keep each favorite's mount options separate.
  • Cache the credentials actually used to mount a volume and preserve cancellation and other non-credential errors during automatic backup-header retries.
  • Reject missing, oversized or incorrectly encoded --stdin passwords instead of silently using an empty or truncated password. Decode the complete first line using the current locale (GH #1935).
  • Require confirmation before replacing an existing container file during command line creation. Use --force to allow replacement without a prompt (GH #1861).
  • Honor --no-size-check during command line container creation (GH #1756).
  • Expose BLAKE2b-512 in random-pool, keyfile-generation and hash-benchmark dialogs, including when using Argon2id.
  • Preserve paths containing XML special characters and literal XML entity text in favorites, volume history and settings (GH #1943).
  • Fall back to English when a language file is unusable, and fix password-length warnings and busy-volume dismount confirmation messages (GH #1944).
    .

• Linux and FreeBSD:

  • Security: Fix a generic installer vulnerability that could let a separate local user replace the embedded package and gain root privileges (GHSA-wf3r-pjv3-fcxx). Distribution packages and AppImage builds aren't affected.
  • Improve volume-file and tray icons, and make desktop cache updates optional when the required utilities aren't installed.
    .

• Linux:

  • Enforce read-only protection on loop devices, all device-mapper layers and filesystems. Automatically mount volumes as read only when the backing block device reports write protection, even if it permits an open request with write access.
  • Forward sync requests for volumes mounted through FUSE to the backing file or device and report flush failures. Previously, a successful sync could leave data in the host cache.
  • Check that devices belong to the selected volume before dismount or filesystem checks. Leave externally supplied host devices attached and refuse normal dismount while a decrypted loop device remains in use.
  • Support writable volume files on shares that restrict root access, including GVfs and NFS with root_squash (GH #23). Keep the share mounted and the user session active until dismount.
  • Improve mounting on minimal systems, including FAT and exFAT detection. Use FUSE automatically when dmsetup isn't installed (GH #1898).
  • Support NixOS helper locations and report when launcher restrictions block administrator authentication (GH #1911).
  • Rewrite mount.veracrypt in POSIX shell, honor read-only options and supported mount(8) flags, reject invalid options, and fix argument quoting (GH #1895, GH #1928).
  • Fix installation on systems with a merged /usr layout (GH #1764).
    .

• macOS:

  • Security: Fix FUSE-T cleanup that could leave decrypted volumes accessible after dismount (CVE-2026-108982, GHSA-f3px-f8h2-fm4c). Protect auxiliary mounts and report when service shutdown can't be confirmed.
  • Security: Validate disk device ownership changes and prefer trusted system utilities when running privileged operations (GH #1758, GH #1790).
  • Fix mounting and dismounting crashes with macFUSE 5.3.3 and later (GH #1887).
  • Fix Check Filesystem and Repair Filesystem so they operate on the selected volume and show their results in Terminal (GH #1791).
  • Add a preference to disable screen protection, which remains enabled by default.
  • Improve disk-image discovery and avoid detaching unrelated disks when device numbers are reused after an external eject. Keep volume status updates responsive.
    .

Upgrade note for FUSE-T users: When upgrading from VeraCrypt 1.26.29, dismount your volumes and restart macOS before using the updated build. Replacing the application doesn't end services that are already running.
.

• FreeBSD:

  • Detect ARM64 AES and SHA-256 hardware acceleration while retaining software fallbacks.
    .

• OpenBSD:

  • Add FFS volume creation in the wizard and on the command line.
    .

• Building and packaging:

  • Fix builds with NOASM or NOSSE2, and Argon2 builds targeting x86-64-v3/v4 or XOP (GH #1891, GH #1896, GH #1906).
  • Fix FreeBSD ARM builds and local Apple Silicon builds (GH #1678, GH #1934). Restore Linux builds with GCC 4.4 and fix INDICATOR=1 tray-menu builds (GH #1823).
  • Let wxWidgets builds follow the parent make's parallel job settings, including OpenWrt builds (GH #1903).
  • Remove OpenWrt's Bash dependency and preserve SDK package selections (GH #1932).
  • Improve macOS signing and notarization validation, and refresh app bundles before packaging.
  • Remove the MFC dependency from Windows driver resource compilation.

[franet65]

Unfortunately, I can't install version 1.29.30 on Windows 11 26H2. I get the following error message: “The structure of the security descriptions is invalid.” The portable version works fine!

[isvik]

Updated to 1.26.30 and ran it without issue for me. I am on windows 10 22H2 latest version. I use it just for container encryption. I have not created any hidden volumes and my system is not encrypted.

[Enigma2Illusion]

Just to add a data point for Mounir Idassi due to what appears to be installer security check issues on Windows 11 that I was successful in upgrading from 1.26.29 to 1.26.30 on Windows 10 Pro 64-bit with Extended Security Updates 22H2 OS Build 19045.7807 which is the latest Windows 10 version.

[Enigma2Illusion]

@idrassi

Also @ulip is reporting two error messages when attempting to upgrade to 1.26.30 from 1.26.29 on Windows 11 without using system encryption at the thread below.

https://sourceforge.net/p/veracrypt/discussion/general/thread/382e940436/

May be coincidence that both @franet65 and @ulip PCs appear to be German language with different error messages.

[Bill Henshaw]

I am trying to install on Win 11 25H2 and I get the same error message using the .exe installer and the .msi installer.

[Mounir IDRASSI]

Thank you for the reports. I have receive similar report on Github. This issue seems to be caused by the extra security checks in the installer to fix potential security issue that was reported. The current implementation seems to be too strict compared to the various possible permissions configuration.

I analyzing this and trying to reproduce it. Meanwhile, I have removed the Windows installers (exe and MSI) and left only portable setup. Once I have better clarify, I will post an update and share a new version with better installer implementation.

[Dominik]

hey, I try to download, but the file does not exist

https://github.com/veracrypt/VeraCrypt/releases/download/VeraCrypt_1.26.30/VeraCrypt.Setup.1.26.30.exe

and

https://github.com/veracrypt/VeraCrypt/releases/download/VeraCrypt_1.26.30/VeraCrypt_Setup_x64_1.26.30.msi

In Github I can only find VeraCrypt Portable for Windows

[Enigma2Illusion]

@mrcrossii

Read the post above your post from the developer. The Windows installers for Exe and MSI are temporarily removed while Mounir Idrassi attempts to recreate issues being reported with the Windows installers.

https://sourceforge.net/p/veracrypt/discussion/general/thread/80439e560d/?limit=25#dea9

[Dominik]

oh yeah, my fault, sorry

[Enigma2Illusion]

@franet65 @ulip @billh99999 and anyone else impacted by the Windows 11 VeraCrypt 1.26.30 Exe or MSI error(s) during installation.

On GitHub which is mainly Linux and Mac users, Mounir Idrassi is asking for help by checking the Windows security settings from users experiencing the problem when attempting to install or upgrade to 1.26.30 using the Exe or MSI installers.

I am copying-and-pasting Mounir's request for help on GitHub that you can read here and here.

You can share your results on SourceForge in this thread.

For those affected, can you please check the security properties of VeraCrypt.exe in both "C:\Program Files\VeraCrypt" and "C:\Windows\System32" and report the displayed owner (as shown when clicking "Advanced" button) and the permissions associated with your current standard user if it is displayed under "Group or user named"?

Please also so the same check on the file "veracrypt.inf", "veracrypt.sys" and "veracrypt.cat" in "C:\Program Files\VeraCrypt".

This will help me narrow down the possible cause.

As a user community, we can help Mounir find the root cause in order to fix the Windows installers for the Windows 11 environment.

EDIT:

So far, there have been no reported problems for Windows 10 without VeraCrypt system encryption.

There is a report of Windows 10 without VeraCrypt system encryption failing upgrade and fresh install of 1.26.30.

https://github.com/veracrypt/VeraCrypt/issues/1955#issuecomment-6426524966

END EDIT

For those using Windows 10 and VeraCrypt 1.26.30 with VeraCrypt system encryption please share their success or failure during installation.

Thank you!

[ulip]

@idrassi and all other with the same expiriences. I checked all the requested files and took three screenshots of the security properties of VeraCrypt.exe at the following locations:

C:\Program Files\VeraCrypt\VeraCrypt.exe

C:\Windows\System32\VeraCrypt.exe

C:\Windows\System32\drivers\VeraCrypt.exe

I also checked the other requested files, veracrypt.inf, veracrypt.sys and veracrypt.cat in C:\Program Files\VeraCrypt, as well as the corresponding files in C:\Windows\System32\drivers.

All files I checked have the same security properties, including the displayed owner and permissions.

The three attached screenshots document the security properties of VeraCrypt.exe at the locations listed above.

For clarity, I use VeraCrypt exclusively for creating and mounting encrypted containers. I have never used VeraCrypt system encryption and have never created a VeraCrypt Rescue Disk.

I hope these findings help narrow down the cause of the installation issues with version 1.26.30.

[Enigma2Illusion]

@ulip

Thank you for your help!

For @idrassi

Ulip's thread was able to successfully complete the 1.26.30 upgrade after getting two error messages about the system loader backup even though ulip is not using VeraCrypt system encryption.

[Bill Henshaw]

In Program files VeraCryptExe shows the Owner as Administrators (xxxxxxx\Administrators). It allows Full Control. I don't use the standard user account, but for it only Read & Execute is allowed. Same for veracrypt.inf and veracrypt.cat.

I see no VeraCrypt.exe file in C:\Windows\System32. I searched for it using Everything and it did not find it anywhere except in C:\Windows\Program Files\VeraCrypt and C:\Windows\Prefetch.

I only use a mounted VeraCrypt file, I do not use System encryption. I am on Win 11 25H2.

[Enigma2Illusion]

@billh99999

Thank you for your help!

What about the permissions for veracrypt.sys in C:\Program Files\VeraCrypt directory?

[Bill Henshaw]

@enigma2illusion

Sorry, missed that one. The same. Administrators have Full control. Users have Read & Execute.

[franet65]

Right now, I'm only using the portable version that works. Sorry!

[M. J.]

@idrassi

I upgraded from 1.26.29 to 1.26.30 with the .exe setups when they were still available. No issues except that now every time i start Veracrypt from the desktop icon or start menu it asks if i wanna create a new rescue-disk. Clicking no or yes won't cancel it. See screenshot attached. My OS was fully encrypted before, but wasn't anymore while upgrading if it helps to narrow the issue down. OS: Windows 11 Pro for Workstations 26H1 Build 28000.3231 German

[Enigma2Illusion]

@bitw

I upgraded from 1.26.29 to 1.26.30 with the .exe setups when they were still available. No issues...

My OS was fully encrypted before, but wasn't anymore while upgrading if it helps to narrow the issue down.

Can you provide the exact steps you took to upgrade?

What specific actions did you perform to remove VeraCrypt system encryption before, during or after the upgrade?

To decrypt VeraCrypt system encryption usually involves:

1. Dismount all mounted VeraCrypt volumes.
2. Use the GUI to System > Permanently Decrypt System Partition/Drive.
3. Once completed in the GUI, you should have been prompted to reboot the PC to complete the removal of VeraCrypt system encryption and the restoration of the MS bootloader.
4. You should no longer have the VeraCrypt bootloader screen at PC boot-up.

If the VeraCrypt bootloader screen still appears after you finish decrypting the OS, you can bypass the VeraCrypt bootloader by pressing the ESC key to allow Windows to repair and/or start the Windows OS.

Once you are booted into the Windows OS, open the VeraCrypt application and select decrypt system encryption again. This will be very quick operation since VeraCrypt will replace the VeraCrypt bootloader with the backup copy of the Windows bootloader and then remove the VeraCrypt bootloader.

[M. J.]

Hi,

it was done exactly as you said:

When i used v1.26.29 i did a full system disk encryption of drive c: - This was like 3 months ago. Then i realized this results in the PC not properly shutting down randomly or hanging on reboot so i decided to undo it and go for a container based solution for my needs instead. Ai suggested back then this is caused due to the bootloader not being digitally signed from MS and random unmounting issues due to that or something.

NOW: There is no VC bootloader anymore on my system drive or anything, decrypting back then was successfull. Some days ago v1.26.30 comes out, i simply upgrade it through the normal setup, and now i get the popup i posted earlier always when i start Veracrypt.

So my guess is that the new version does not read out the correct status of encryption (or lack there of) of the system drive, because i can certainly guarantee that it never happend when i was still using v1.26.29 - i opened Veracrypt all the time to see my status of mounted containers etc.

[Enigma2Illusion]

@bitw @idrassi

Thank you for the clearer explaination. The developer will need to engage this 1.26.30 issue on your Windows 11 Pro for Workstations 26H1 Build 28000.3231 German PC.