This update introduces a screen protection mechanism that leverages the Windows Display Affinity API to prevent screen capture, screen recording, and inclusion in the Windows 11 Recall feature. By default, all VeraCrypt windows, menus, and tooltips are protected. Users can enable or disable this feature through a new setting available in the application Preferences, as well as in the installer and MSI configurations.
This enhances user privacy by mitigating potential leaks of sensitive interface content.
Note: Due to a regression in Windows 11 affecting layered windows, ComboBox dropdowns cannot currently be protected by this mechanism.
* refactor: use UNMOUNT instead of DISMOUNT in code
This change updates the term DISMOUNT in constants to UNMOUNT.
Other occurrences (e.g. variable names) are left alone for now.
* refactor(ui): use unmount instead of dismount
This change updates the GUI text and replaces dismount with unmount.
* docs: update term dismount -> unmount
* refactor(cmdline): add unmount
This change adds an argument 'unmount' for command line usage, while
trying to deprecate the old disnount argument.
The current dismount argument/flag will still work to not introduce
a breaking change.
* docs: mention that /dismount is deprecated
This change fixes the shorthand version of the argument /unmount
It also adds back the info for /dismount and that it is deprecated.
Added security checks to prevent mounting VeraCrypt volumes on system directories (like /usr/bin) or directories in the user's PATH, which could theoretically allow execution of malicious binaries instead of legitimate system binaries.
Key changes:
- Block mounting on protected system directories (/usr, /bin, /lib, etc.)
This restriction cannot be overridden
- Block mounting on directories present in user's PATH environment variable
This can be overridden with --allow-insecure-mount flag
- Add visual warnings (red border, "[INSECURE MODE]") when mounting on PATH directories is allowed
- Handle symlinks properly when checking paths
- Add new error messages for blocked mount points
To override PATH-based restrictions only (system directories remain protected):
veracrypt --allow-insecure-mount [options] volume mountpoint
Security Impact: Low to Medium
The attack requires either:
- User explicitly choosing a system directory as mount point instead of using VeraCrypt's default mount points
- Or attacker having both filesystem access to modify favorites configuration AND knowledge of the volume password
Default mount points are not affected by this vulnerability.
Security: CVE-2025-23021
If vulnerability detected, a warning message is displayed during mount or backup/restore header, and changing the password is disallowed since it will not change the master key.
* Implement Language selection into settings
Initial commit to create a new tab in PreferencesNotebook for
Language selection. By default, if nothing is chosen, it uses the
current behaviour of using the language from system environment
variables. If another language is chosen from the settings, it is
saved into the Configuration.xml and this is used instead.
* Fix SetStringSelection() assert issue on macOS
* Add header include to fix build
* Add current language pack, authors and way to use literal strings
* Translations also for FreeBSD
* Minimal GTK3 WX build on FreeBSD requires wxGraphicsContext
* Get Preferences properly instead of workaround function
* Use WrapSizer instead of BoxSizer for author line
This forces long author lists to be put on a new line, reducing
the need to increase window width.
* Update Finnish translation
* Borrow translation from IDM_LANGUAGE where it makes sense
* Remove colon and thus unneeded function
* Simplify Language tab layout
* Reintroduce macOS specific fixes to Forms.cpp
* cleanup
The usage of /Y parameter in format.com simplifies the logic and makes the code robust since we don't need to send \n to the format.com process.
Specifying RemovableMedia parameter to FormatEx fixes its failure in Windows 10 and later to perform quick format. This is also more adequate since we are mounting the volume as removable media for the formatting process.
We also add better error management in order to display adequate error message to the user in case of failure
* Add basic strcture needed for EMV implementation
* Add demo EMV functionality with C code pasted in a very dirty and unsafe way. NOT FINAL
* Refactor IccExtractor Structure
* Fix Makefile
* fix include file
* move global variables from h to c
* revert to memcpy
* fix icc data recovery functions
* Add EMV functionalities on windows
* Make EMVToken structures like SecurityToken
* Define constants instead of hard coded values
* Token structures created with inheritance
* refactor TokenKeyfile to use inherit. + polymor.
* add Token.h + Token.cpp in modules in VS2010
* Add a comment at each use of SecurityToken class or objects
* SecurityTokenKeyfilesDialog preparation
* Implemennt GetAvailableTokens in Token class on windows
* merge
* up (patching for Windows)
* foreach Token.cpp corrected
* Display EMV keyfiles on first window in graphic interface
* Add token to Windows UI
* EMVToken selection on OKButton on Linux
* Keyfile.cpp optimization
* Move getKeyfileData in the token class
* EMV::Token GetAvailableKeyfiles() base
* Move getKeyfileData in the token class on unix
* Remove test comments
* Warnings resolved
* RemoveeSecurityTokenLibraryNotInitialized exception if at least one emv token is detected
* Adding new files
* Remove old files and add the new version to the windows project
* Change make_shared to shared_ptr constructor
* IccExtractor integration working on linux
* Throwing card not EMV execption
* catch error when not EMV type in EMVToken::GetAvailableKeyfiles
* Change types to compile on windows
* list all keyfiles, security keyfiles and emv keyfiles in command line
* Change type to be coherent and remove old todo comments
* Remove todo comments
* Change indentation and resolve a bug from previous commit
* Use polymorphism for GetKeyfileData and add export option for EMVTokens on Linux
* Linux : Allow to export EMV Tokens in command lines, Windows : Disable the delete button when EMV Keyfiles are selected
* Remove SlotId from TokenInfo as it is already in Token
* Correct errors on Linux
* Disable delete option if one EMV Token is selected on Linux
* Fix bug enabling delete button if nothing is selected
* emv data used as reference then burnt
* use of normal files in linux corrected
* help updated
* help updated for export functionnality
* option EMV added to graphic interface but not yet working
* Bug fix : Allow to use multiple EMV on windows
* EMV Option added to UserPreferences
* EMV Option working for Linux
* EMV option added to Windows (not working yet)
* [NOT TESTED] EMV option for Windows
* Working EMV option on Windows
* EMV Option for data extraction working for volume creation
* EMV Option for data extraction working for Mount
* EMV Option for data extraction working for mounting favorites volumes
* EMV Option for extraction working for Changing volume password, Set Derivation Key Algorithm and Add or remove keyfile from volume
* Windows : re-checking EMV Option when getting data
* Removing error catches in the IccDataExtractor classe (It only throws error now). Changing GetPan signature to resemble the other functions signatures more
* Changing EMV errors
- Only throwing ICCExtractionException from outside of the ICC module.
- Catching all TLVExceptions and PCSCExceptions to throw the right ICCExtractionException
- Deleting APDU exceptions.
* First version of the documentation
* Adding function pointers for winscard library (but it crashes VeraCrypt)
* Debugging function pointers
* The import of the library on windows work as expected now
* Reverting EMVToken.cpp changes used to test to library import
* Searching for the System32 path instead of hard codding it
* Fixing the bug were VeraCrypt crashes if there is no readers when "add Token files" is clicked
* Winscard library not initialized in object constructor anymore to delay it after EMVOption check
* Remove winscard lib from windows dependencies
* Properly displaying errors
* Adding a dot in Language.xml
* Catching TLVException
* Removing unused code
* Remove unusefull comments
* Trying to fix 0x1f error
* Update IccDataExtractor.cpp
* Delete History.xml
* Fix get data without get pan
* Cleanup code
* changes for linux compilation but linking not working
* error handling for linux
* erasing emv data
* Burn PAN
* Burn PAN from memory
* Uncomment selfcheck before merging master
* burn corrected
* EMV errors handling for Linux
* EMV working for Linux CLI
* Doc : Winscard Linux package and VeraCrypt versions
---------
Co-authored-by: doriandu45 <d45.poubelle@gmail.com>
Co-authored-by: red4game <redemgaiming@gmail.com>
Co-authored-by: Brice.Namy <brice.namy@insa-rennes.fr>
Co-authored-by: vocthor <pieceo108@gmail.com>
Co-authored-by: vocthor <67202139+vocthor@users.noreply.github.com>
Co-authored-by: Andrei COCAN <andrei.cocan@insa-rennes.fr>
Co-authored-by: AndreiCocan <95496161+AndreiCocan@users.noreply.github.com>
Co-authored-by: francoisLEROUX <francois3443@gmail.com>
This change also makes it possible to generate keyfiles larger than 1 MiB although only the first 1 MiB will be taken into account by VeraCrypt.
Update strings in XML files
Currently on a system without xterm or konsole (like fresh
Ubuntu install) the fsck check will not launch. Added
gnome-terminal as an alternative and fixed an issue where
konsole will always error out as --title and --caption are
no longer valid arguments.
Previously the error message was simply "xterm not found", so
new LangString LINUX_EX2MSG_TERMINALNOTFOUND was added to let the
user knows which programs they need to get the feature working.
* New VeraCrypt interface (for system encryption) with improved usability
* System Encryption: translate password to US keyboard layout + improved new interface
* Windows: Fix build error following merge
* Windows: Remove unused variable
* Windows: Add missing string in Language.xml
* Windows: fix buffer overrun caused by wrong use of wmemset
* Do not delete password file
Since the file is only available in \Release\Setup Files\ it would be fully deleted after running this script the first time.
* Correct return code
Originally the function would have always returned the return-code 1 resulting that the user is not able to change the location for the rescue zip.
* Added hint for sysenc
Added a hint why the field for repeating the password is initially greyed out within the system encryption.
* Corrected spelling mistake
Corrected spelling mistake
* Removed not working copy job
The file to be copied was stored at the source location. Therefore the copyjob will not work. Instead the file is already in the target folder.
* Removed RIPEMD-160 from Product64.wxs
See commit from 21.03.2022
* Added german translation for new interface
* Fixed PIM bug
* Corrected translation file based on the guidelines within the pull request
* Fixing merge conflicts
* Fixed Compiling issues. Reverted keyboard translation
* Removed artifacts of password translation
* Corrected language.xml
* Fixed order within german language file
* Corrected positions
Co-authored-by: Bruna2803 <bruna.radeljak@hotmail.com>
Co-authored-by: felixreichmann <30237956+felixreichmann@users.noreply.github.com>
Co-authored-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
* new xml Tag for en and de
* add linux support for env LANG
* precopiled header into TrueCrypt.fdp to substitute '_()' with 'LangString[]'
* more LangString in Code
* add Language xml's to Linux Setup location
* backup language for linux is en
* remove Language.en.xml install
* rearange new xml lines to end
* yes/no dialogs now translated
* All OK/Cancel Button now support international
Co-authored-by: tb@tbon.de <tb@tbon.de>
