github veracrypt/VeraCrypt VeraCrypt_1.26.30
VeraCrypt 1.26.30
on GitHub

3 hours ago

Downloads: Jump directly to installers, packages, source archives, checksums and signatures

Changes between 1.26.29 and 1.26.30 (24 October 2026):

  • All OSes:

    • Security: Improve erasure of security token data and limit smart card responses to prevent hangs or excessive memory use.
    • Fix unintended reuse of the current PIM when switching KDFs in the password-change and header-KDF dialogs. The selected KDF's default PIM is now used unless a new PIM is explicitly specified.
    • Fix cryptographic errors on processors using big endian byte order. Prevent alignment crashes on affected processors, including 32 bit ARM. (GH #1899, GH #1908, GH #1909)
    • Fix ChaCha output when processing successive partial blocks.
    • Improve encryption worker error handling and wait for active work to finish before shutdown.
    • Update translations and correct missing entries, formatting placeholders and escaped punctuation.
    • Expand documentation for EFI Secure Boot certificate migration, KDF selection, supported operating systems and Windows builds.

  • Windows:

    • Security: Fix GHSA-w98h-pqh6-wfjj: insufficient protection of system encryption support files could enable local privilege escalation during a qualifying Windows feature update or tampering with the BIOS loader during restoration. Protect setup scripts, driver packages and recovery backups, and reject untrusted legacy backups and driver sources.

    • Security: Fix GHSA-9mgv-w2fw-3m78: prevent local disclosure of limited disk metadata.

    • Fix driver stability regressions reported with VeraCrypt 1.26.29 and improve cleanup during mounting and dismounting. Restore the previous I/O completion behavior and disable ordered flush barriers by default.

    • Handle processor state-save failures safely during key derivation and fix KDF worker completion and startup cleanup.

    • Improve system encryption setup and upgrade failure handling. Retain recovery backups during uninstall, warn when an encrypted system's original loader backup is unavailable, and keep Windows Setup configuration failures independent of boot-loader repair.

    • Prevent incompatible EFI bootloader installation when Secure Boot is enabled. Refresh the Windows Boot Manager copy from compatible Windows files.

    • Warn when installed boot components need CA migration and prompt users to recreate the Rescue Disk after bootloader certificate changes.

    • Correct dismount status reporting and drive removal notifications, including command line dismounts. (GH #1852)

    • Prevent repeated errors when a favorite set to mount on device arrival has a drive letter already occupied by another device.

    • Update stored favorite volume PIM/KDF metadata after password or header KDF changes.

    • Fix Argon2 and Argon2id command line aliases, and accept n to disable /protectScreen and /protectMemory.

    • Fix windows and dialogs appearing off screen or on the wrong monitor. (GH #1858, GH #1865, GH #1912)

    • Fix favorite labels containing XML characters and prevent label text from changing saved mount options. (GH #1946)

    • Preserve Unicode paths and literal XML entity text in saved settings. Prevent extra carriage returns from accumulating when configuration files are rewritten.

    • Fix partially translated interfaces and untranslated menu items and benchmark controls. (GH #1587, GH #1929, GH #1930)

    • Update bundled zlib to 1.3.2 and LZMA SDK to 26.02.

    • Favorite labels when downgrading: Back up your ordinary and system favorite volume configuration files before downgrading. Older versions can display XML escapes in labels and keep that text when saving, even after you upgrade again. Restore your backups or correct the labels after returning to this version.

    • Upgrade note for system encryption: Install the updated VeraCrypt before preparing a Windows feature update, and resolve any Windows update support or original loader backup warning. If Windows Setup has already staged support files, restart feature-update preparation so it stages the updated files; installing VeraCrypt does not replace a previously staged script. Preserve existing recovery backups and a known trustworthy VeraCrypt Rescue Disk. Changing an old backup's ownership or permissions does not establish that its contents are safe.

  • Linux, macOS and BSD:

    • Security: Fix GHSA-4j3p-7hp7-xw73: prevent a heap buffer overflow, out-of-bounds reads and excessive memory allocations when deserializing requests in the privileged service.

    • Security: Prevent privileged-service communication and authentication file descriptors from leaking into child processes.

    • Detect CPU features before starting core services so mounted volumes use available hardware acceleration. Correct failed instruction probes on older processors. (GH #1939)

    • Preserve forced read-only protection when mounting partially encrypted system volumes through FUSE.

    • Make unattended unmount commands return a nonzero exit status when a busy volume can't be unmounted.

    • Support doas when sudo isn't available, including opendoas on FreeBSD. Avoid repeated password prompts after successful authentication.

    • Preserve hidden volume protection when mounting favorites, including during credential retries. Keep each favorite's mount options separate.

    • Cache the credentials actually used to mount a volume and preserve cancellation and other non-credential errors during automatic backup-header retries.

    • Reject missing, oversized or incorrectly encoded --stdin passwords instead of silently using an empty or truncated password. Decode the complete first line using the current locale. (GH #1935)

    • Require confirmation before replacing an existing container file during command line creation. Use --force to allow replacement without a prompt. (GH #1861)

    • Honor --no-size-check during command line container creation. (GH #1756)

    • Expose BLAKE2b-512 in random-pool, keyfile-generation and hash-benchmark dialogs, including when using Argon2id.

    • Preserve paths containing XML special characters and literal XML entity text in favorites, volume history and settings. (GH #1943)

    • Fall back to English when a language file is unusable, and fix password-length warnings and busy-volume dismount confirmation messages. (GH #1944)

  • Linux and FreeBSD:

    • Security: Fix GHSA-wf3r-pjv3-fcxx: a generic installer vulnerability could let a separate local user replace the embedded package and gain root privileges. Distribution packages and AppImage builds aren't affected.
    • Improve volume-file and tray icons, and make desktop cache updates optional when the required utilities aren't installed.

  • Linux:

    • Enforce read-only protection on loop devices, all device-mapper layers and filesystems. Automatically mount volumes as read only when the backing block device reports write protection, even if it permits an open request with write access.
    • Forward sync requests for volumes mounted through FUSE to the backing file or device and report flush failures. Previously, a successful sync could leave data in the host cache.
    • Check that devices belong to the selected volume before dismount or filesystem checks. Leave externally supplied host devices attached and refuse normal dismount while a decrypted loop device remains in use.
    • Support writable volume files on shares that restrict root access, including GVfs and NFS with root_squash. (GH #23) Keep the share mounted and the user session active until dismount.
    • Improve mounting on minimal systems, including FAT and exFAT detection. Use FUSE automatically when dmsetup isn't installed. (GH #1898)
    • Support NixOS helper locations and report when launcher restrictions block administrator authentication. (GH #1911)
    • Rewrite mount.veracrypt in POSIX shell, honor read-only options and supported mount(8) flags, reject invalid options, and fix argument quoting. (GH #1895, GH #1928)
    • Fix installation on systems with a merged /usr layout. (GH #1764)

  • macOS:

    • Security: Fix GHSA-f3px-f8h2-fm4c: correct FUSE-T cleanup that could leave decrypted volumes accessible after dismount. Protect auxiliary mounts and report when service shutdown can't be confirmed.

    • Security: Validate disk device ownership changes and prefer trusted system utilities when running privileged operations. (GH #1758, GH #1790)

    • Fix mounting and dismounting crashes with macFUSE 5.3.3 and later. (GH #1887)

    • Fix Check Filesystem and Repair Filesystem so they operate on the selected volume and show their results in Terminal. (GH #1791)

    • Add a preference to disable screen protection, which remains enabled by default.

    • Improve disk-image discovery and avoid detaching unrelated disks when device numbers are reused after an external eject. Keep volume status updates responsive.

    • Upgrade note for FUSE-T users: When upgrading from VeraCrypt 1.26.29, dismount your volumes and restart macOS before using the updated build. Replacing the application doesn't end services that are already running.

  • FreeBSD:

    • Detect ARM64 AES and SHA-256 hardware acceleration while retaining software fallbacks.

  • OpenBSD:

    • Add FFS volume creation in the wizard and on the command line.

  • Building and packaging:

    • Fix builds with NOASM or NOSSE2, and Argon2 builds targeting x86-64-v3/v4 or XOP. (GH #1891, GH #1896, GH #1906)
    • Fix FreeBSD ARM builds and local Apple Silicon builds. (GH #1678, GH #1934) Restore Linux builds with GCC 4.4 and fix INDICATOR=1 tray-menu builds. (GH #1823)
    • Let wxWidgets builds follow the parent make's parallel job settings, including OpenWrt builds. (GH #1903)
    • Remove OpenWrt's Bash dependency and preserve SDK package selections. (GH #1932)
    • Improve macOS signing and notarization validation, and refresh app bundles before packaging.
    • Remove the MFC dependency from Windows driver resource compilation.

Merged Pull Requests

New Contributors

Full Changelog: VeraCrypt_1.26.29...VeraCrypt_1.26.30

Downloads

Detached GPG signatures are provided as sig links next to each download.

Check out latest releases or
releases around veracrypt/VeraCrypt VeraCrypt_1.26.30

Don't miss a new VeraCrypt release

NewReleases is sending notifications on new releases.

Get notifications