CVE-2026-34462
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Sandboxie-Plus 1.17.2 and earlier, ProcessServer handlers have stack buffer overflows due to wcscpy without null termination check. A local attacker can achieve code execution as SYSTEM.
Risk Assessment
Any local process can connect to the service pipe and overflow the stack, leading to privilege escalation to SYSTEM.
Recommendation
Update Sandboxie-Plus to version 1.17.3 or later.
Other vulnerabilities in Sandboxie-Plus
See all- CVE-2026-45313High
A vulnerability in Sandboxie-Plus before version 1.17.6 allows a sandboxed process to execute arbitrary code in an unsandboxed host process. The GuiServer::WndHookRegisterSlave and GuiServer::WndHookNotifySlave functions do not validate thread handles and function pointers, enabling privilege escalation.
- CVE-2026-34596High
In Sandboxie-Plus versions 1.17.2 and earlier, a TOCTOU race condition exists during addon installation. After UpdUtil.exe verifies file hashes, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM.
- CVE-2026-34527Medium
In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.
- CVE-2026-34464High
In Sandboxie-Plus 1.17.2 and earlier, the NamedPipeServer::OpenHandler has a stack buffer overflow due to wcscat without null termination check. A sandboxed attacker can escape and achieve code execution as SYSTEM.
- CVE-2026-34461High
In Sandboxie-Plus 1.17.2 and earlier, the SbieIniServer RunSbieCtrl handler has a stack buffer overflow due to memcpy without length check. A local attacker can achieve code execution as SYSTEM.
- CVE-2026-34459High
Sandboxie-Plus versions 1.17.2 and earlier have two vulnerabilities in the SbieSvc service: uninitialized stack memory leak and stack buffer overflow. Chained, they allow sandbox escape and SYSTEM privilege escalation. Fixed in version 1.17.3.
- CVE-2026-34458High
Sandboxie-Plus versions 1.17.2 and earlier have an INI injection vulnerability. Any standard local user can bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters. An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation.
Original NVD description (English source)
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.