How severe is CVE-2019-19501?

CVE-2019-19501 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-19501 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-19501?

CVE-2019-19501 affects Idrix Veracrypt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-19501?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-19501 published?

CVE-2019-19501 was published on 2019-12-13 and last updated on 2026-06-17.

CVE-2019-19501

CVE-2019-19501 is a high-severity vulnerability in Idrix Veracrypt with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 4.6
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Idrix Veracrypt
Published: 2019-12-13
Last modified: 2026-06-17

Description

VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe.

Frequently asked questions

What is CVE-2019-19501?: VeraCrypt 1.24 allows Local Privilege Escalation during execution of VeraCryptExpander.exe.
How severe is CVE-2019-19501?: CVE-2019-19501 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-19501 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-19501?: CVE-2019-19501 affects Idrix Veracrypt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-19501?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-19501 published?: CVE-2019-19501 was published on 2019-12-13 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:idrix:veracrypt:1.24:*:*:*:*:*:*:*

More vulnerabilities in Idrix Veracrypt

CVE-2015-7359 — High (CVSS 7.8): The (1) IsVolumeAccessibleByCurrentUser and (2) MountDevice methods in Ntdriver.c in TrueCrypt 7.0, VeraCrypt before…
CVE-2015-7358 — High (CVSS 7.8): The IsDriveLetterAvailable method in Driver/Ntdriver.c in TrueCrypt 7.0, VeraCrypt before 1.15, and CipherShed, when…
CVE-2016-1281 — High (CVSS 7.8): Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and…
CVE-2019-1010208 — Low (CVSS 3.3): IDRIX, Truecrypt Veracrypt, Truecrypt Prior to 1.23-Hotfix-1 (Veracrypt), all versions (Truecrypt) is affected by:…

All CVEs affecting Idrix Veracrypt →