CVE-2014-2885: Truecrypt Project Truecrypt

High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.

Affected products

• Truecrypt Project Truecrypt: version 7.1 only

Published 2018-03-19. Last modified 2026-06-17.