CVE-2026-34459
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Sandboxie-Plus versions 1.17.2 and earlier have two vulnerabilities in the SbieSvc service: uninitialized stack memory leak and stack buffer overflow. Chained, they allow sandbox escape and SYSTEM privilege escalation. Fixed in version 1.17.3.
Risk Assessment
An attacker from within a sandboxed process can gain full system control, bypassing all sandbox protections.
Recommendation
Update Sandboxie-Plus to version 1.17.3 or later.
Other vulnerabilities in Sandboxie-Plus
See all- CVE-2026-45313High
A vulnerability in Sandboxie-Plus before version 1.17.6 allows a sandboxed process to execute arbitrary code in an unsandboxed host process. The GuiServer::WndHookRegisterSlave and GuiServer::WndHookNotifySlave functions do not validate thread handles and function pointers, enabling privilege escalation.
- CVE-2026-34596High
In Sandboxie-Plus versions 1.17.2 and earlier, a TOCTOU race condition exists during addon installation. After UpdUtil.exe verifies file hashes, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM.
- CVE-2026-34527Medium
In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.
- CVE-2026-34464High
In Sandboxie-Plus 1.17.2 and earlier, the NamedPipeServer::OpenHandler has a stack buffer overflow due to wcscat without null termination check. A sandboxed attacker can escape and achieve code execution as SYSTEM.
- CVE-2026-34462High
In Sandboxie-Plus 1.17.2 and earlier, ProcessServer handlers have stack buffer overflows due to wcscpy without null termination check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34461High
In Sandboxie-Plus 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler has a stack buffer overflow due to memcpy without length check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34458High
Sandboxie-Plus versions 1.17.2 and earlier have an INI injection vulnerability. Any standard local user can bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters. An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation.
Original NVD description (English source)
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieSvc proxy service's GetRawInputDeviceInfoSlave handler contains two vulnerabilities that can be chained for sandbox escape. First, when a sandboxed process sends an IPC request with cbSize set to 0, up to 32KB of uninitialized stack memory from the service process is returned, leaking return addresses and stack cookies which bypass ASLR and /GS protections. Second, the handler performs a memcpy with an attacker-controlled length without verifying it fits within the 32KB stack buffer, enabling a stack buffer overflow. By chaining the information leak with the overflow, a sandboxed process can execute a ROP chain to achieve SYSTEM privilege escalation, even from a Security Hardened Sandbox. Hardware-enforced shadow stacks (Intel CET) prevent the ROP chain execution but do not mitigate the information leak. This issue has been fixed in version 1.17.3.