VULNERABILITY INTELLIGENCE

CVE-2014-2885

CVSS score7.1 HIGH
EPSS probability0.29%
CISA KEVNot currently listed
Published2018-03-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Description

Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.

Weakness classification

  • CWE-190: Integer Overflow or Wraparound
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-400: Uncontrolled Resource Consumption

Primary references