VeraCrypt

Recent Commits

• Nick (15 Jul 26)

  Update Swedish translation (#1825) * Update Swedish translation * Update Language.sv.xml * Update Language.sv.xml * Update Language.sv.xml * Update Language.sv.xml * Update Language.sv.xml

• Mounir IDRASSI (14 Jul 26)

  Merge commit from fork Restrict caller-supplied object-manager and disk paths used by metadata IOCTLs to the forms required by VeraCrypt. Also force symlink access checks, remove the unused legacy geometry handler, authorize real-drive probing before name resolution, and gate cache wiping on successful emergency key clearing. Security advisory: https://github.com/veracrypt/VeraCrypt/security/advisories/GHSA-9mgv-w2fw-3m78/

• Mounir IDRASSI (10 Jul 26)

  Windows: make EFI trust checks dbx-aware Reject revoked loader CA sets and diagnose the chainloaded Windows manager. Add PCA 2011 migration warnings and update Secure Boot guidance.

• Nick Haghiri (13 Jul 26)

  Linux: fix tray icon menu build with INDICATOR=1 (#1823) A few menu item labels were passed as wxString instead of .mb_str(), which doesn't compile against wxWidgets 3.2. One label in the same function already did it right, the rest didn't.

• Mounir IDRASSI (08 Jul 26)

  Unix: isolate auto-mount options and EMV settings Clone command-line auto-mount options before device and favorite batches, and clone the batch options again for each favorite before applying favorite-specific fields. This prevents interactive credentials, PIM, KDF choices, and per-favorite filesystem settings from carrying over to later favorites. Propagate EMVSupportEnabled through MountOptions serialization and mount setup so elevated core service requests use the same EMV setting as the caller.

• Matthaiks (08 Jul 26)

  Update Polish translation (#1814) * Update Polish translation * Update Polish translation * Update Polish translation

• Mounir IDRASSI (06 Jul 26)

  docs: add EFI Secure Boot page covering the 2023 CA transition Document the two Microsoft-signed loader sets and their firmware db requirements, the EfiBootLoader diagnostics registry key, and the BIOS third-party certificates option needed on machines that ship with a 2023-only Secure Boot configuration. Explain why the Windows Secure Boot certificate rollout does not trigger automatically on system-encrypted machines, how to trigger it via the documented AvailableUpdates registry value, the precautions to take, and the recovery procedures when Secure Boot blocks the boot chain. Link the page from the System Encryption documentation and the CHM table of contents.

• Mounir IDRASSI (06 Jul 26)

  Windows: warn when Secure Boot stops trusting the boot chain Track Microsoft Windows Production PCA 2011 and Windows UEFI CA 2023 in the firmware db parser so the trust of the chainloaded Windows boot manager copy (bootmgfw_ms.vc) can be verified. Add BootEncryption::GetEfiBootChainTrustStatus to check the installed VeraCrypt loader set and the bootmgfw_ms.vc signer against the active Secure Boot db, asserting nothing from malformed or partial firmware data. Warn before reboot during Setup upgrade/repair and log a System Favorites service event when a boot chain component is no longer trusted, so Secure Boot certificate changes surface in Windows instead of as a pre-boot failure. Refs #1655.

• Mounir IDRASSI (04 Jul 26)

  OpenBSD: add FFS volume formatting support Expose FFS as the native OpenBSD filesystem option for volume creation and accept FFS/UFS on the command line, mapping mounts to the OpenBSD ffs filesystem type. Run newfs through the elevated core service on vnd raw devices, then temporarily mount the new filesystem to transfer root directory ownership back to the invoking user. Keep the non-interactive creation default as FAT on OpenBSD so existing unattended scripts do not start requiring elevation.

• Mounir IDRASSI (05 Jul 26)

  Fix Simplified Chinese translation spacing

• nkh0472 (05 Jul 26)

  Update Language.zh-cn.xml (#1813) * Update Language.zh-cn.xml * Update Language.zh-cn.xml

• Mounir IDRASSI (02 Jul 26)

  FreeBSD: support opendoas elevation Reuse the OpenBSD doas PTY prompt flow on FreeBSD so opendoas receives the password through its controlling terminal. Apply the same foreground process group validation on FreeBSD as on OpenBSD when attaching the private doas authentication PTY. Detect the incompatible FreeBSD security/doas package by pkg origin and fail with explicit guidance.

• Mounir IDRASSI (02 Jul 26)

  Windows: harden work item completion drain before queue cleanup Decrement ActiveWorkItems only after the completion work item has returned queue resources and released its pool item. EncryptedIoQueueStop now synchronizes with WorkItemLock after the active count drains, ensuring the last work item has stopped touching queue state before the work item pool and buffer pools are freed.

• Mounir IDRASSI (02 Jul 26)

  Windows: fix work item pool cleanup on allocation failure and queue restart Zero the preallocated work item pool before the shared error cleanup can scan it, since driver TCalloc uses uninitialized pool memory. Also clear WorkItemPool after EncryptedIoQueueStop frees it so a reused queue cannot retry cleanup through a stale pointer on a later start failure.

• Mounir IDRASSI (01 Jul 26)

  Windows: disable ordered flush barriers by default Keep ordered flush barrier support available behind the new VC_DRIVER_CONFIG_ENABLE_ORDERED_FLUSH_BARRIERS driver configuration flag. With the flag clear, non-system IRP_MJ_FLUSH_BUFFERS requests complete successfully as they did before d1f73ce4 instead of entering EncryptedIoQueue. This narrows the default Windows driver behavior while investigating 1.26.29 instability reports, but retains an opt-in path for targeted testing of ordered flush barriers. The close-time best-effort host flush is now gated by the same flag, so default close and dismount behavior also matches the pre-d1f73ce4 path.

• Mounir IDRASSI (01 Jul 26)

  Windows: revert CriticalWorkQueue IRP completion dispatch Revert the IRP completion dispatch changes from a7ebddc5 while keeping later ordered flush barrier handling intact. This restores the previous model where ordinary early completions are completed directly and queued final completions use DelayedWorkQueue. The CriticalWorkQueue dependency was introduced as a follow-up to the deferred completion deadlock fix, but current Windows instability reports point to it as a likely regression risk. Returning to the 1.26.24-style completion path narrows the driver behavior change while preserving the documented deadlock mitigation architecture.

• Nick (30 Jun 26)

  Update Swedish translation (#1805) * Update Swedish translation * Update Language.sv.xml * Update Language.sv.xml

• Mounir IDRASSI (30 Jun 26)

  Unix: harden doas startup fd handling Move child pipe descriptors away from stdio slots before remapping them, avoiding collisions when 0/1/2 are closed. On OpenBSD, wait for authentication-terminal output before writing the doas password, avoiding prompt text matching while keeping the startup timeout as the upper bound.

• Mounir IDRASSI (30 Jun 26)

  Unix: harden OpenBSD doas authentication startup Keep OpenBSD doas stderr on the private authentication PTY because doas requires stderr to be a terminal while prompting. Capture authentication-terminal diagnostics, strip prompts from user-facing errors, and fail promptly on explicit authentication denial. Wait for actual prompt bytes before sending the password so OpenBSD PTY POLLIN|POLLHUP before slave open cannot race with readpassphrase terminal flushing.

• Mounir IDRASSI (30 Jun 26)

  Unix: harden elevated service fd inheritance Set close-on-exec on elevated-service startup pipes before fork and centralize duplication onto standard descriptors. Clear FD_CLOEXEC on descriptors intentionally kept across exec, including dup2(fd, fd) no-op cases.

• Mounir IDRASSI (29 Jun 26)

  Unix: fix doas auth PTY opening on OpenBSD OpenBSD defines O_CLOEXEC, but rejects it in posix_openpt() with EINVAL. Retry with the POSIX pseudoterminal flags and then set FD_CLOEXEC explicitly so doas authentication can create its private PTY.

• Mounir IDRASSI (29 Jun 26)

  Windows: Update LZMA SDK to version 26.02

• TigerxWood (28 Jun 26)

  Update Language.ro.xml (#1802) * Update Language.ro.xml 1. Made some more corrections. 2. Also on line 1543 there is an 'Options &gt;' &gt; ... I did not find anywhere 'Options &gt;' is this maybe about key="IDC_MOUNT_OPTIONS">Mount Opti&amp;ons...</entry> * Update Language.ro.xml * Update Language.ro.xml Final edit

• Mounir IDRASSI (28 Jun 26)

  Clarify Linux system encryption mount option text

• Mounir IDRASSI (28 Jun 26)

  Update various translations

• Mounir IDRASSI (28 Jun 26)

  Fix Linux mount options help menu path

• TigerxWood (28 Jun 26)

  Update Language.ro.xml (#1800) * Update Language.ro.xml Version 1.26.29 * Update Language.ro.xml version 1.26.29

• Marius Kjærstad (26 Jun 26)

  Update Norwegian Bokmål translation (#1799) * Update Norwegian Bokmål translation * Fix for two issues

• Mounir IDRASSI (25 Jun 26)

  Update translations

• Mounir IDRASSI (25 Jun 26)

  Update Swedish translation