sandboxie-plus Sandboxie up to 1.17.2 on Windows NAMED_PIPE_OPEN_REQ stack-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in sandboxie-plus Sandboxie up to 1.17.2 on Windows. Affected is an unknown function. Performing a manipulation of the argument NAMED_PIPE_OPEN_REQ results in stack-based overflow. This vulnerability is cataloged as CVE-2026-34464. The attack must be initiated from a local position. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. It has been classified as critical. This affects an unknown code. The manipulation of the argument NAMED_PIPE_OPEN_REQ with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, NamedPipeServer::OpenHandler copies the server field from NAMED_PIPE_OPEN_REQ into a fixed WCHAR pipename[160] stack buffer using wcscat without verifying null termination. The handler only enforces a minimum packet size, and since the service pipe accepts variable-length messages, a sandboxed caller can fill the server[48] field with non-zero data and append additional controlled wide characters after the structure. wcscat then reads past the fixed field and overflows the stack buffer in the SYSTEM service. This message is restricted to sandboxed callers, making it a sandbox escape vector. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-34464 since 03/27/2026. The exploitability is told to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.17.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27464). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• sandboxie-plus

Name

• Sandboxie

Version

• 1.17.0
• 1.17.1
• 1.17.2

Website

• Product: https://github.com/sandboxie-plus/Sandboxie/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion