sandboxie-plus Sandboxie up to 1.17.2 on Windows Background Service Sandboxie.ini crlf injection

Summaryinfo

A vulnerability, which was classified as critical, was found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. This issue affects some unknown processing of the file Sandboxie.ini of the component Background Service. Such manipulation leads to crlf injection. This vulnerability is traded as CVE-2026-34458. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in sandboxie-plus Sandboxie up to 1.17.2 on Windows. Affected by this issue is some unknown functionality of the file Sandboxie.ini of the component Background Service. The manipulation with an unknown input leads to a crlf injection vulnerability. Using CWE to declare the problem leads to CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, an INI injection vulnerability allows any standard local user to bypass configuration restrictions (EditAdminOnly and ConfigPassword) and inject arbitrary directives into the global Sandboxie.ini configuration file. The background service skips authorization checks for IPC messages targeting sections beginning with UserSettings_, but does not sanitize CRLF characters in either the value parameter (via MSGID_SBIE_INI_ADD_SETTING) or the setting name parameter (via MSGID_SBIE_INI_SET_SETTING). An attacker can inject a new sandbox section header with unrestricted permissions, enabling sandbox escape and SYSTEM privilege escalation. This issue has been fixed in version 1.17.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-34458 since 03/27/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

By approaching the search of inurl:Sandboxie.ini it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.17.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27456). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• sandboxie-plus

Name

• Sandboxie

Version

• 1.17.0
• 1.17.1
• 1.17.2

Website

• Product: https://github.com/sandboxie-plus/Sandboxie/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion