Windows Drivers are True’ly Tricky

Summary: Project Zero's James Forshaw described a flaw in the TrueCrypt Windows driver, in the TC_IOCTL_MOUNT_VOLUME and TC_IOCTL_DISMOUNT_VOLUME handlers in Driver\Ntdriver.c, that lets an application running as a normal user or inside a low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or the kernel. The bug survived a prior security audit, and Forshaw notes it did not directly affect the security of encrypted volumes at rest.
Why it matters: The flaw turns a routine unmount into a primitive that deletes a global drive-letter symbolic link, so a low-integrity sandbox can reach SYSTEM or kernel - and it was found in code that had already been through a security audit.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026