Critical Vuln: UTM VM on macOS auto-remounts unmounted VeraCrypt volumes without credentials

Vulnerability Overview Title: Critical Security Flaw: Unmounted volume automatically remounts without credentials upon launching UTM Virtual Machine on macOS 26.5.1+ (Apple Silicon) #1779 Description: On macOS 26.5.1+ (Apple Silicon), when using the UTM virtual machine application, VeraCrypt volumes are automatically remounted even after they have been unmounted, without requiring any credentials. This allows unauthorized access to files within the encrypted volume. Scope of Impact Affected Systems: macOS version 26.5.1 and later, specifically on Apple Silicon architectures. Affected Applications: VeraCrypt and the UTM virtual machine application. Risk Level: High, as data in encrypted volumes may be accessed by unauthorized users. Remediation Status 1. Manual Unmounting: Attempted to manually unmount the volume via terminal commands, but the data remained accessible. 2. Terminating Background Processes: Checked and terminated related background processes, but the issue persisted. 3. Restarting Finder: Restarted Finder, but the problem remained unresolved. 4. Investigating Network/NFS Stack: Inspected local RPC and network status, but no effective solution was found. 5. Using FUSE Mounts: Utilized auxiliary mount points built with FUSE, but the issue continued to occur. Proof of Concept (PoC) Code Conclusion This vulnerability demonstrates that on macOS, even after a volume is unmounted, the system automatically remounts it and exposes the encrypted data. Currently, there is no effective mitigation. It is recommended that users avoid using the UTM virtual machine application to access encrypted volumes on affected systems.

Goal Reached Thanks to every supporter — we hit 100%!

Critical Vuln: UTM VM on macOS auto-remounts unmounted VeraCrypt volumes without credentials

More from this source