CVE-2026-34458
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Sandboxie-Plus versions 1.17.2 and earlier have an INI injection vulnerability. Any standard local user can bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters. An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation.
Risk Assessment
An attacker can completely bypass sandbox isolation and gain SYSTEM privileges, allowing full control over the operating system.
Recommendation
Immediately upgrade Sandboxie-Plus to version 1.17.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Sandboxie-Plus
See all- CVE-2026-45313High
A vulnerability in Sandboxie-Plus before version 1.17.6 allows a sandboxed process to execute arbitrary code in an unsandboxed host process. The GuiServer::WndHookRegisterSlave and GuiServer::WndHookNotifySlave functions do not validate thread handles and function pointers, enabling privilege escalation.
- CVE-2026-34596High
In Sandboxie-Plus versions 1.17.2 and earlier, a TOCTOU race condition exists during addon installation. After UpdUtil.exe verifies file hashes, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM.
- CVE-2026-34527Medium
In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.
- CVE-2026-34464High
In Sandboxie-Plus 1.17.2 and earlier, the NamedPipeServer::OpenHandler has a stack buffer overflow due to wcscat without null termination check. A sandboxed attacker can escape and achieve code execution as SYSTEM.
- CVE-2026-34462High
In Sandboxie-Plus 1.17.2 and earlier, ProcessServer handlers have stack buffer overflows due to wcscpy without null termination check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34461High
In Sandboxie-Plus 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler has a stack buffer overflow due to memcpy without length check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34459High
Sandboxie-Plus versions 1.17.2 and earlier have two vulnerabilities in the SbieSvc service: uninitialized stack memory leak and stack buffer overflow. Chained, they allow sandbox escape and SYSTEM privilege escalation. Fixed in version 1.17.3.
Original NVD description (English source)
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.