CVE-2026-34527
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.
Risk Assessment
Reduced password hash entropy makes it easier for attackers to recover passwords from leaked or backed-up configuration files.
Recommendation
Update Sandboxie-Plus to version 1.17.3 or later.
Original NVD description (English source)
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 digest to hexadecimal incorrectly. The high nibble of each byte is shifted right by 8 instead of 4, which always produces zero for an 8-bit value. As a result, the stored EditPassword hash only preserves the low nibble of each digest byte, reducing the effective entropy from 160 bits to 80 bits. This is layered on top of an unsalted SHA-1 scheme. The reduced entropy makes leaked or backed-up password hashes materially easier to brute-force. This issue has been fixed in version 1.17.3.