sandboxie-plus Sandboxie up to 1.17.2 on Windows SandMan Interface UpdUtil.exe toctou

Summaryinfo

A vulnerability classified as critical has been found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. Affected by this issue is some unknown functionality of the file UpdUtil.exe of the component SandMan Interface. The manipulation leads to toctou. This vulnerability is documented as CVE-2026-34596. The attack needs to be performed locally. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. It has been rated as critical. This issue affects some unknown processing of the file UpdUtil.exe of the component SandMan Interface. The manipulation with an unknown input leads to a toctou vulnerability. Using CWE to declare the problem leads to CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a Time-of-Check-to-Time-of-Use (TOCTOU) race condition exists during addon installation. When a user installs an addon through the SandMan interface, UpdUtil.exe is spawned as SYSTEM by SbieSvc but stages files in the user-writable %TEMP%\sandboxie-updater directory. After UpdUtil verifies file hashes against the signed addon manifest, install.bat extracts files.cab and executes config.exe from its contents. Between hash verification and extraction, an unprivileged user can replace files.cab with a crafted cabinet containing a malicious executable, which is then run as SYSTEM. No UAC prompt is required. This issue has been fixed in version 1.17.3.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-34596 since 03/30/2026. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 1.17.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27468). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• sandboxie-plus

Name

• Sandboxie

Version

• 1.17.0
• 1.17.1
• 1.17.2

Website

• Product: https://github.com/sandboxie-plus/Sandboxie/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion