sandboxie-plus Sandboxie up to 1.17.2 on Windows ProcessServer stack-based overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. This vulnerability affects the function KillAllHandler/SuspendAllHandler/RunSandboxedHandler of the component ProcessServer Handler. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2026-34462. The attack requires local access. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. Affected by this vulnerability is the function KillAllHandler/SuspendAllHandler/RunSandboxedHandler of the component ProcessServer Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, several ProcessServer handlers (KillAllHandler, SuspendAllHandler, and RunSandboxedHandler) copy a WCHAR boxname[34] field from request structures into WCHAR[40] stack buffers using wcscpy without verifying null termination. Because the service pipe accepts variable-length packets larger than the request structure, an attacker can fill the boxname field with non-zero data and append additional controlled wide characters after the structure. wcscpy then reads past the fixed field and overflows the destination stack buffer. The service pipe is created with a NULL DACL, allowing any local process to connect, and the unsafe copy occurs before authorization checks. This can lead to a crash of the SbieSvc service or potential code execution as SYSTEM. This issue has been fixed in version 1.17.3.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-34462 since 03/27/2026. The exploitation appears to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.17.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27462). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• sandboxie-plus

Name

• Sandboxie

Version

• 1.17.0
• 1.17.1
• 1.17.2

Website

• Product: https://github.com/sandboxie-plus/Sandboxie/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion