{"id":"CVE-2015-7358","aliases":["EUVD-2015-7282","GHSA-4c78-fxq8-6rxg"],"status":"published","title":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15,...","description":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01205,"percentile":0.68487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2017-10-02T19:00:00Z","modified":"2026-06-17T00:32:18Z","exploits":[{"source":"exploitdb","id":"EDB-38403","title":"TrueCrypt 7 / VeraCrypt 1.13 - Drive Letter Symbolic Link Creation Privilege Escalation","type":"local","platform":"windows_x86","date":"2015-10-05","verified":true,"url":"https://www.exploit-db.com/exploits/38403"}],"products":[{"vendor":"ciphershed","product":"ciphershed"},{"vendor":"idrix","product":"veracrypt"},{"vendor":"truecrypt","product":"truecrypt"}],"references":[{"url":"https://veracrypt.codeplex.com/wikipage?title=Release%20Notes","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/38403/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/24/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/133878/Truecrypt-7-Derived-Code-Windows-Drive-Letter-Symbolic-Link-Creation-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/22/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://code.google.com/p/google-security-research/issues/detail?id=538","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7358"},{"url":"https://www.exploit-db.com/exploits/38403"},{"url":"https://github.com/advisories/GHSA-4c78-fxq8-6rxg"}],"sources":{"cve":[{"id":"CVE-2015-7358","description":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.","status":"published","published":"2017-10-02T19:00:00Z","modified":"2024-08-06T07:43:46.183Z","updated_at":"2026-11-02T14:35:44.744952Z"}],"euvd":[{"id":"EUVD-2015-7282","description":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.","status":"published","published":"2017-10-02T19:00:00Z","modified":"2024-08-06T07:43:46Z","updated_at":"2026-11-03T02:21:52.959489Z"}],"ghsa":[{"id":"GHSA-4c78-fxq8-6rxg","title":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15,...","description":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.","status":"published","published":"2022-05-13T01:09:07Z","modified":"2025-04-20T03:46:08Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:01:52.186588Z"}],"nvd":[{"id":"CVE-2015-7358","description":"The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when running on Windows, does not properly validate drive letter symbolic links, which allows local users to mount an encrypted volume over an existing drive letter and gain privileges via an entry in the /GLOBAL?? directory.","status":"published","published":"2017-10-03T01:29:00.717Z","modified":"2026-06-17T00:32:18.383Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:19.244941Z"}]}}