CVE-2026-34461
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Sandboxie-Plus 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler has a stack buffer overflow due to memcpy without length check. A local attacker can achieve code execution as SYSTEM.
Risk Assessment
Any local interactive process can connect to the service pipe and overflow the stack, leading to privilege escalation to SYSTEM.
Recommendation
Update Sandboxie-Plus to version 1.17.3 or later.
Other vulnerabilities in Sandboxie-Plus
See all- CVE-2026-45313High
A vulnerability in Sandboxie-Plus before version 1.17.6 allows a sandboxed process to execute arbitrary code in an unsandboxed host process. The GuiServer::WndHookRegisterSlave and GuiServer::WndHookNotifySlave functions do not validate thread handles and function pointers, enabling privilege escalation.
- CVE-2026-34596High
In Sandboxie-Plus versions 1.17.2 and earlier, a TOCTOU race condition exists during addon installation. After UpdUtil.exe verifies file hashes, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM.
- CVE-2026-34527Medium
In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.
- CVE-2026-34464High
In Sandboxie-Plus 1.17.2 and earlier, the NamedPipeServer::OpenHandler has a stack buffer overflow due to wcscat without null termination check. A sandboxed attacker can escape and achieve code execution as SYSTEM.
- CVE-2026-34462High
In Sandboxie-Plus 1.17.2 and earlier, ProcessServer handlers have stack buffer overflows due to wcscpy without null termination check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34459High
Sandboxie-Plus versions 1.17.2 and earlier have two vulnerabilities in the SbieSvc service: uninitialized stack memory leak and stack buffer overflow. Chained, they allow sandbox escape and SYSTEM privilege escalation. Fixed in version 1.17.3.
- CVE-2026-34458High
Sandboxie-Plus versions 1.17.2 and earlier have an INI injection vulnerability. Any standard local user can bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters. An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation.
Original NVD description (English source)
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler contains a stack buffer overflow. The MSGID_SBIE_INI_RUN_SBIE_CTRL message is handled before normal sandbox and impersonation checks, and for non-sandboxed callers, the handler copies the trailing message payload into a fixed-size WCHAR ctrlCmd[128] stack buffer using memcpy without verifying the length fits within the buffer. The service pipe is created with a NULL DACL, allowing any local interactive process to connect and send an oversized payload to overflow the stack. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.